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CHAPTER  1.0  -  INTRODUCTION 


Cracking  and  subsequent  component  failures  due  to  fatigue,  corrosion,  stress  corrosion  and 
corrosion/fatigue  are  major  threats  to  aircraft  structural  safety.  Such  cracking  can  originate  from 
manufacturing  defects,  material  defects,  unforeseen  high  local  stresses  resulting  from  design  and 
analysis  errors  or  test  deficiencies,  environmental  damage,  and  service  induced  maintenance 
deficiencies.  Also,  discrete  source  impacts  from  bird  strike,  ground  equipment,  dropped  tools, 
runway  debris,  uncontained  engine  rotor  failures  and  explosive  penetrations  are  serious  threats  to 
structural  safety.  Although  these  impacts  are  generally  accidental,  they  can  inflict  very  large 
damage  and  should  be  protected  against  to  the  maximum  practical  extent.  Eventually  an 
operational  limit  will  be  reached  in  metallic  structures  with  the  onset  of  widespread  fatigue 
damage  (WFD)  or  generalized  fatigue  cracking.  At  that  point  safety  can  no  longer  be  assured  and 
the  structural  component(s)  should  be  modified,  or  replaced.  This  report  discusses  the  threats  and 
provides  a  historical  perspective  as  to  how  the  military,  the  Federal  Aviation  Administration 
(FAA)  and  industry  have  dealt  with  these  threats  over  the  years. 

The  report  includes  a  Compendium  of  Selected  Structural  Accident/Incidents.  The  Compendium 
is  organized  by  Appendices  that  specifically  address  the  results  of  the  threats  to  structural  safety. 
These  accidents  and  incidents  illustrate  the  oftentimes  disastrous  consequences  of  the  threats. 
While  there  have  been  lessons  learned  from  nearly  all  of  the  accidents  and  incidents,  those  that 
were  seminal  with  respect  to  the  design  and  certification  of  aircraft  structures  were  the  1954 
Comet  failures,  the  1958  B-47  accidents,  the  1969  F-lll  accident,  the  1976  AVRO  748  accident, 
the  1978  Dan  Air  707  Fusaka  accident  and  the  1988  Aloha  Boeing  737  accident.  The  Comet 
failures  resulted  in  the  use  of  fail-safe  design  in  commercial  aircraft;  the  B-47  accidents  resulted 
in  the  development  of  the  Air  Force  Aircraft  Structural  Integrity  Program  (ASIP);  the  F-lll 
accident  accelerated  the  introduction  of  damage  tolerance  design  requirements  in  military 
aircraft;  the  AVRO  748  and  Dan  Air  Boeing  707  accidents  resulted  in  complementing 
commercial  fail-safe  design  with  damage  tolerance  requirements;  and  the  Aloha  Boeing  737 
accident  brought  attention  to  the  importance  that  WFD  has  in  limiting  the  safe  operation  of 
airplane  structures. 

The  lessons  learned  from  these  past  accidents/incidents  and  the  changes  in  structural  design,  test 
and  analysis  requirements  have  been  evolutionary  in  nature  with  some  changes  having  much 
more  of  a  positive  impact  than  others.  The  change  that  had  the  greatest  positive  impact  on  the 
structural  safety  of  commercial  transport  aircraft  was  the  development  of  the  fail-safe  design 
concept,  largely  as  a  result  of  the  Comet  failures.  This  concept  has  undoubtedly  prevented  an 
untold  number  of  catastrophic  accidents  (approximately  40  are  mentioned  in  the  Compendium, 
i.e.,  Appendices  B.2,  A. 10,  C.2,  E.l,  E.2,  F.2-F.7,  G.1-G.3,  and  1.1).  However,  not  all 
commercial  airplanes  were  designed  to  the  Civil  Aeronautics  Board  (CAB)  fail-safe  option  [1], 
Due  to  the  state  of  the  art  of  fracture  mechanics  in  the  1950s,  the  CAB  rule  did  have  some 
shortcomings  that  became  more  apparent  as  a  result  of  the  AVRO  748  and  Dan  Air  Boeing  707 
accidents  and  the  Boeing  737  Aloha  accident.  These  accidents  (along  with  advancements  in 
fracture  mechanics  technology)  resulted  in  the  FAA  incorporating  damage  tolerance  based 
inspection  requirements  and  full-scale  fatigue  test  requirements  in  the  Code  of  Federal 
Regulations  (CFR),  but  unfortunately  this  came  at  the  expense  of  reduced  emphasis  on  fail-safe 
design.  Contrary  to  the  intentions  of  the  Aircraft  Industry  Association  (AIA)  committee  that 


1 


oversaw  the  change  in  the  FAA  regulation  (i.e.,  amendment  45  to  FAR  25.571  [2])  after  the 
AVRO  748  and  Dan  Air  accidents,  the  explicit  fail-safe  design  requirement  was  inadvertently 
omitted. 

In  1999  the  FAA’s  Technical  Oversight  Group  on  Aging  Aircraft  (TOGAA)  attempted  to  get  the 
regulation  amended  to  explicitly  require  fail-safe  design  of  commercial  transport  aircraft; 
however,  the  effort  failed  when  TOGAA  objected  to  the  changes  that  a  joint  U.S.  and  European 
working  group  (called  the  General  Structures  Harmonization  Working  Group,  GSHWG) 
proposed.  TOGAA  recommended  to  the  FAA  that  it  was  better  to  stay  with  the  implicit  fail-safe 
requirements  included  in  the  1998  amendment  96  to  FAR  25.571  [3]  than  accept  the  GSHWG 
proposal. 

The  need  still  exists  today  to  have  the  FAR  explicitly  require  that  all  safety-of-flight  structure  in 
commercial  transport  aircraft  be  designed  to  be  fail-safe  in  spite  of  the  fact  that  some 
manufacturers  have  such  self  imposed  design  requirements.  The  lack  of  such  a  rule  could  lead  to 
a  relaxation  of  self  imposed  requirements  and  subsequent  catastrophic  failures  in  the  future. 

With  regard  to  military  aircraft,  the  change  that  had  the  greatest  positive  impact  on  structural 
safety  was  the  introduction  of  damage  tolerance  requirements  in  the  early  1970s  subsequent  to 
the  F-lll  accident  in  1969.  While  the  introduction  of  ASIP  in  1958  [4],  was  important,  it  still 
assumed  flaw-free  structure  and  promoted  the  use  of  single  load  path  structure  and  safe-life 
concepts  (conventional  stress-life  fatigue  analysis  and  Miner’s  Rule).  As  a  result  many  fatigue 
failures  continued  throughout  the  1960s  and  early  1970s. 

The  1969  F-lll  accident  highlighted  the  catastrophic  effect  that  an  initial  material  or 
manufacturing  flaw  can  have  on  non-fail-safe  structure.  With  the  1974  revisions  to  ASIP  (in 
MIL-STD-1530A  [5]),  the  introduction  of  detailed  damage  tolerance  requirements  (in  MIL-A- 
83444  [6])  and  the  performance  of  Durability  and  Damage  Tolerance  Assessments  (DADTAs) 
on  all  of  the  US  Air  Force  aircraft,  the  losses  of  military  aircraft  due  to  structural  failure  were 
greatly  diminished. 

However,  in  recent  years  inspection  reliability  has  become  a  significant  issue  both  due  to  frailties 
of  the  nondestructive  inspection  (NDI)  systems  and  concern  over  inspectors  becoming 
complacent  as  a  result  of  performing  numerous  repeat  inspections  looking  for  rogue  flaws 
without  any  finds  [7-10].  The  inspection  issue  becomes  even  more  acute  as  aging  weapon 
systems  approach  the  onset  of  WFD.  The  inspection  burden  and  aircraft  down  times  tend  to 
overwhelm  the  depots  and  jeopardize  both  safety  and  operational  readiness.  To  avoid  this 
probability,  the  Air  Force  has  established  operational  limits  (i.e.,  service  life  limits)  in  each 
aircraft’s  Airworthiness  Certificate.  Also,  the  USAF  has  been  promoting  greater  use  and 
reliance  on  fail-safe  design  concepts,  which  require  only  visual  inspections.  During  2007  and 
2008,  C.F.  Tiffany  assisted  the  USAF  Aeronautical  Systems  Center  Engineering  Directorate 
(ASC/EN)  in  drafting  structural  bulletins  that  address  revisions  in  the  damage  tolerance 
requirements  for  fail-safe  and  non-fail-safe  (i.e.,  slow  crack  growth)  structures.  The  revisions  for 
fail-safe  and  non-fail-safe  structures  are  contained  in  Structures  Bulletins  EN-SB-08-001  [11] 
and  -002,  [12]  respectively.  Also,  a  third  Bulletin  (-003  [13])  was  published  on  performing  fail¬ 
safe  assessments  of  current  Air  Force  aircraft. 
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The  report  also  discusses  maintenance  of  airworthiness;  this  discussion  is  separated  into  three 
parts  that  address  operational  limits  according  to  the  USAF  defined  structural  concepts: 


•  Multiple  Load  Path,  Fail-Safe  Structure 

•  Crack  Arrest,  Fail-Safe  Structure 

•  Non-fail-safe,  Single  Load  Path  Structure 

This  approach  was  taken  since  it  is  clear  that  the  operational  limits  on  fail-safe  structure  are 
reached  when  the  major  components  have  reached  the  time  when  the  onset  of  widespread  fatigue 
damage  has  occurred.  It  is  less  clear  what  the  operational  limits  should  be  on  single  load  path 
structure. 

For  the  multiple  load  path,  fail-safe  structure,  the  onset  of  widespread  fatigue  damage  occurs 
when  the  crack  population  in  the  component  has  degraded  the  load  carrying  capability  of  the 
adjacent  structure  so  that  when  the  primary  element  fails,  the  adjacent  structure  can  no  longer 
carry  the  required  residual  strength  load.  This  situation  of  widespread  fatigue  damage  is  referred 
to  as  multiple  element  damage. 

For  the  crack  arrest,  fail-safe  structure,  the  onset  of  widespread  fatigue  damage  occurs  when  the 
population  of  small  cracks  within  the  component  are  of  sufficient  number  size  and  density  such 
that  rapid  crack  propagation  of  the  lead  crack  or  inflicted  damage  will  not  be  arrested  and  thus 
the  required  residual  strength  in  the  presence  of  the  design  damage  size  cannot  be  achieved.  This 
situation  of  widespread  fatigue  damage  is  referred  to  as  multiple  site  damage. 

Single  load  path  structure  has  been  traditionally  protected  against  structural  failure  using  the 
damage  tolerance  (DT)  concept  of  slow  crack  growth  and  DT-based  inspections.  It  was 
assumed  that  one  could  continue  inspecting  such  structures  without  end  of  life  limits,  until  the 
economic  and  loss  of  readiness  burden  became  intolerable.  This  assumption  is  re-examined  and 
an  operational  limit  based  on  durability-related  fatigue  cracking  that  overwhelms  the  inspection 
system  is  suggested. 

For  all  three  structural  concepts,  operational  limits  of  USAF  aircraft  are  ultimately  dictated  by 
the  inability  of  the  structure  to  maintain  its  required  residual  strength  in  the  presence  of  damage 
at  a  structural  risk  level  exceeding  a  single  flight  probability  of  failure  of  10'5  per  flight.  To 
ensure  continuing  airworthiness,  it  is  essential  to  take  action  (e.g.,  perform  different  types  of 
inspections,  replace  the  component  or  implement  flight  restrictions  or  groundings)  to  maintain 
the  single  flight  probability  of  failure  below  10'7  per  flight  and  minimize  exposure  between  10'7 
and  10'5per  flight  according  to  MIL-STD-1530C. 


3 


This  page  intentionally  left  blank 


4 


CHAPTER  2.0  -  THREATS 


The  purpose  of  this  chapter  is  to  discuss  the  threats  to  structural  safety  and  to  illustrate  each 
threat’s  impact  to  the  potential  for  aircraft  accidents/incidents  by  a  citing  historical  structural 
failures  resulting  from  these  threats.  The  serious  threats  to  structural  safety  are: 

•  High  Local  Stresses 

•  Manufacturing  and  Material  Defects 
.  Maintenance  Defects/Deficiencies 

•  Environmental  Damage 

•  Discrete  Source  Impact  (sub-categories) 

■  Ground  equipment 

■  Uncontained  Engine  Failures 

■  Bird  Strikes 

■  Runway  Debris 

•  Explosive/Ballistic  Penetrations 

•  Excessive  Operational  Loads 

•  Widespread  Fatigue  Damage 

Table  1  was  created  to  provide  a  roadmap  relating  the  threats  to  the  Chapter  2  sections,  to  the 
corresponding  appendix  illustrating  accidents/incidents  associated  with  the  threat  and  to 
summarize  the  number  of  accidents/incidents  that  a  given  appendix  group  contains. 

Table  1.  Roadmap  for  Accidents/Incidences  Appendices 


Threat 

Sections 

Appendix  Group 

Number  of  Appendices 
in  Group 

High  local  stresses 

2.1 

A 

11 

Manufacturing  and  material  defects 

2.2 

B 

5 

Maintenance  damage/deficiencies 

2.3 

C 

5 

Environmental  damage 

2.4 

D 

2 

Impact  from  ground  equipment 

2.5.1 

E 

2 

Impact  due  to  uncontained  engine 
failures 

2.5.2 

F 

7 

Impact  due  to  bird  strikes 

2.5.3 

G 

3 

Impact  due  to  runway  debris 

2.5.4 

H 

1 

Explosive/ballistic  penetrations 

2.6 

I 

1 

Excessive  operational  loads 

2.7 

None 

None 

Widespread  fatigue  damage 

2.8 

J 

2 

Many  early  aircraft  accidents/incidents  resulted  from  high  stress  locations  that  nucleated  fatigue 
cracks  under  operational  loading.  These  high  stress  locations  were  typically  not  identified  until 
the  accidents/incidents  occurred.  The  early  accidents/incidents,  however,  were  not  just  the  result 
of  the  high  local  stress  threat;  the  structures  that  failed  typically  were  manufactured:  1)  from  high 
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strength  materials  having  both  low  resistance  to  fatigue  cracking  and  low  crack  tolerance 
(implying  short  final  crack  sizes),  and  2)  with  manufacturing  and/or  material  defects  (resulting  in 
life  variability  and  which  magnified  the  effect  of  high  local  stresses).  The  Comet  problem  (See 
Appendix  A.l)  in  many  respects  was  not  that  much  different  than  the  results  observed  with 
military  airplanes  designed  in  the  1950s  and  1960s  (See  Appendices  A. 2  through  A. 6  and  B.l 
through  B.4). 

In  the  late  1950s,  the  solution  to  preventing  catastrophic  fatigue  failures  of  commercial  aircraft 
(and  large  military  transport  and  bomber  aircraft)  was  to  ensure  that  the  design  resulted  in  a 
structure  which  had  sufficient  structural  redundancy  to  maintain  adequate  residual  strength  after 
any  structural  element  failed.  Aircraft  manufactured  using  the  structural  redundancy  concept 
became  known  as  fail-safe  structure.  The  capability  of  fail-safe  structure  to  carry  the  required 
residual  strength  was  demonstrated  initially  by  experimental  testing,  because  analytical  fracture 
mechanics  had  not  yet  matured.  Appendix  K  describes  the  early  development  of  fail-safe  testing 
by  US  aircraft  manufacturers.  In  these  early  years  of  establishing  fail-safe  structure,  fracture 
mechanics  had  not  been  proven  to  support  its  use  in  design. 

Operational  lives  were  established  using  fatigue  tests  and  design  analyses  utilized  safe-life 
fatigue  analysis  methods  based  on  elastic  stress  analysis,  stress-fatigue  life  (S-N)  curves,  and 
Miner’s  Rule.  This  approach  also  incorporated  the  evolving  technology  of  reliability  analysis. 
The  stress-fatigue  life  curves  were  based  on  smooth  bar  fatigue  tests  and  notched  coupon  fatigue 
tests. 

In  the  later  part  of  the  1950s  and  beyond,  part  of  the  fatigue  design  verification  usually  included 
at  least  one  full-scale  fatigue  test.  One  of  the  main  functions  of  the  full-scale  fatigue  test  was  to 
uncover  local  high  stress  locations  which  were  not  identified  by  the  structural  analysis.  Many  of 
the  aircraft  that  were  operating  in  the  late  1950s  and  early  1960s  did  not  have  a  full-scale  fatigue 
test  until  after  failures  due  to  fatigue  in  high  stress  locations  occurred.  For  military  aircraft,  it 
was  realized  in  the  late  1950s  that  operational  loads  monitoring  was  a  key  element  required  to 
establish  operational  lives  beyond  the  initial  full-scale  fatigue  test.  Unfortunately,  in  the  early 
years,  the  safe-life  fatigue  analysis  approach  did  not  accurately  capture  the  rates  at  which  fatigue 
damage  was  accumulating  in  service. 

For  those  aircraft  that  had  design  operational  lives  validated  by  full-scale  fatigue  tests  (FSFT) 
there  still  were  early  fatigue  failures  in  service;  these  in-service  failures  were  found  to  start  at 
manufacturing  and  material  defects.  For  example,  the  F-5  (Appendix  A. 6)  was  fatigue  tested  to 
16,000  cyclic  test  hours  without  failure,  but  failed  in  1900  hours  due  to  a  tool  mark  in  a  highly 
stressed  radius  at  the  speed  brake  cut-out  in  the  lower  wing  surface,  the  KC-135  (Appendix  B.2) 
was  fatigue  tested  to  55,000  cyclic  test  hours  without  failure,  but  experienced  28  instances  of 
unstable  cracking  (at  1,800  to  17,000  flight  hours)  in  the  wings  due  to  poor  quality  fastener  holes 
in  a  very  low  toughness  material,  and  the  F- 111  (Appendix  B.5)  was  eventually  cycled  to  40,000 
cyclic  test  hours  (10  lifetimes)  but  failed  in  105  hours  due  to  a  relatively  large  forging  flaw  in  a 
low  toughness  material.  The  lack  of  correlation  between  operational  lives  validated  during  the 
design  phase  and  those  experienced  during  operational  experience  resulted  in  significant  concern 
to  the  aircraft  community. 
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During  the  late  1960s  and  beyond,  analytical  fracture  mechanics  was  demonstrated  for  accurately 
predicting:  1)  critical  crack  sizes  in  aircraft  structure,  2)  crack  growth  behavior,  and  3)  the  effects 
of  various  structural  configurations  on  crack  behavior  (both  slow  crack  growth  and  critical  crack 
extension).  This  capability  made  it  possible  to  extend  the  structural  design  tool  box  to  include 
and  anticipate  the  effects  of  manufacturing  and  material  defects  in  aircraft  structures.  The 
capability  of  fracture  mechanics  tools  to  predict  the  crack  growth  behavior  in  aircraft  structure 
made  it  the  “approach  of  choice”  for  determining  inspection  requirements  and  operational  limits 
(in  essence  replacing  the  safe-life  approach).  The  fracture  mechanics  tools  provided  the  ability 
to  correlate  fatigue  test  results  (crack  behavior)  with  expected  behavior  in  service. 

However,  there  were  still  challenges  correlating  full-scale  fatigue  test  results  and  operational 
experience.  Two  aircraft  (i.e.,  the  F-4,  see  Appendix  A. 6,  and  the  Dan  Air  Boeing  707,  see 
Appendix  A. 9)  were  subjected  to  severe  operational  cyclic  load  spectra  that  were  not  simulated 
in  the  original  fatigue  test  and  for  one  aircraft  (the  Aer  Lingus  Boeing  707,  see  Appendix  A.  10), 
there  is  considerable  doubt  as  to  whether  this  aft  area  of  the  fuselage  was  included  in  the  original 
707  hydro-fatigue  test. 

Ultimately,  the  combination  of  experimental  testing,  operational  load  monitoring  and  analytical 
fracture  mechanics  has  provided  the  structural  engineer  with  the  tools  for:  1)  predicting  the 
residual  strength  of  aircraft  structure  experiencing  crack  damage;  and,  2)  predicting  fatigue  crack 
growth  for  use  in  establishing  inspection  requirements. 

2.1  High  Local  Stresses 

During  the  late  1940s  and  early  1950s  the  primary  emphasis  in  the  development  of  military  jet 
aircraft  was  static  strength  and  there  were  no  design  service  life  requirements.  As  these  aircraft 
went  into  service  operation,  structural  failures  began  occurring  and  there  were  many  fatal 
accidents,  believed  caused  by  high  local  stresses.  It  was  quickly  determined  that  during  service, 
fatigue  cracks  were  initiating  at  high  stress  concentration  zones  within  the  structure.  During  this 
early  period,  there  was  no  requirement  for  full-scale  fatigue  testing  which  in  many  cases  would 
have  revealed  the  cracking  sites  not  uncovered  during  initial  design  analysis.  Appendix  A 
provides  summaries  of  accidents/incidents  associated  with  high  local  stresses.  See  Table  2  for  a 
listing  of  accidents/incidents  covered. 

Appendix  A.l  discusses  the  two  accidents  associated  with  catastrophic  failures  of  the  first  jet 
passenger  aircraft,  the  Comet.  The  catastrophic  failure  of  these  two  Comet  airplane  fuselages  in 
1954,  due  to  uncontained  fatigue  cracking,  had  high  local  stresses  around  cut-outs  not  disclosed 
by  the  original  fatigue  test.  During  the  failure  investigation,  manufacturing  defects  were  also 
found  in  the  recovered  aircraft.  Traditionally,  Comet  failures  have  been  associated  with  high 
local  stresses,  so  we  have  elected  to  include  these  accidents  under  this  threat  category. 
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Table  2.  Accidents/Incidents  Resulting  from  High  Local  Stresses 


Appendix 

Aircraft  Accident/Incident  Identified 

Time  Period 

A.l 

BO  AC  Comet  G-ALYP  and  G-ALYY 

Jan  &  Apr  1954 

A.2 

USAF  Northrop  F-89 

Spring  &  Summer  1952 

A.3 

USAF  Republic  F-84 

1952-1954 

A.4 

USAF  North  American  F-86 

Throughout  1955 

A.5 

USAF  Boeing  B-47 

Mar  &  Apr  1958 

A.6 

USAF  McDonnell-Douglas  F-4 

1960s  and  early  1970s; 
Jan  1973  (Nellis  AFB) 

A.l 

Northwest  Airlines  Martin  202 

Aug  1948 

A.8 

Argentine  State  Owned  YPF  AVRO  748 

Apr  1976 

A.9 

Dan  Air  Airlines  Boeing  707-300 

May  1977 

A.  10 

Aer  Lingus-Irish  International  Airlines  Boeing  707- 
300 

Sep  1970 

A.l  1 

USAF  McDonnell-Douglas  F-15C 

Nov  2007 

During  the  early  jet  age,  failures  also  occurred  in  military  combat  aircraft.  Failures  that  occurred 
in  three  different  fighter  aircraft  models  (i.e.,  F-89,  F-84,  and  F-86)  are  briefly  discussed  in 
Appendices  A.2  through  A. 4,  respectively.  The  exact  causes  of  these  accidents  remain 
uncertain;  however,  they  were  generally  attributed  to  fatigue  cracking  due  to  high  stresses 
resulting  from  excessive  external  loads,  poor  design  and/or  a  manufacturing  deficiency.  While 
these  accidents  were  tragic,  the  problem  of  structural  fatigue  of  military  aircraft  did  not  reach 
crisis  proportions  until  1958,  when  there  were  five  B-47  losses  in  the  period  of  March  13  through 
April  15,  1958  as  discussed  in  Appendix  A. 5.  As  a  result  of  these  B-47  losses,  General  Curtis 
LeMay,  the  USAF  Chief  of  Staff,  directed  the  Air  Force  to  initiate  an  Aircraft  Structural 
Integrity  Program  (AS IP)  [14,  15]. 

The  new  1958  Air  Force  ASIP  required  a  “safe-life”  fatigue  design  approach  based  on  the 
assumption  of  initially  flaw  free  structure.  A  stress-life  fatigue  analyses  (using  Miner’s  rule)  plus 
a  scatter  factor  of  four  were  required  to  arrive  at  the  safe-life  estimates.  Likewise  full-scale 
fatigue  tests  were  required  to  four  times  the  design  life  goal  to  validate  the  operational  life. 
Furthermore,  a  flight  loads  monitoring  program  (operational  surveys)  was  initiated  for  military 
aircraft  to  determine  if  the  aircraft  were  being  operated  to  the  spectrum  to  which  it  was  designed, 
This  approach  was  used  throughout  the  1960s  and  early  1970s.  There  was  no  specific  fail-safe 
requirement,  since  it  was  believed  that  combat  aircraft  could  not  tolerate  the  weight  penalties 
involved.  Nevertheless,  the  airplane  manufacturers  generally  designed  the  military  transports  to 
be  fail-safe  to  the  CAR  4b270  requirements  with  an  eye  on  getting  potential  derivative 
commercial  aircraft  certified  by  the  commercial  regulatory  authorities. 

While  flight  restrictions  and  modifications,  which  were  imposed  on  the  B-47,  were  able  to 
prevent  any  further  losses  due  to  fatigue  before  they  were  retired  by  1966,  the  new  safe-life 
design  and  test  requirements  did  not  prevent  failures  and  the  loss  of  many  other  military  aircraft 
in  the  1960s  and  early  1970s  directly  due  to  fatigue. 
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Several  of  these  later  failures  are  discussed  in  the  compendium  including  the  F-4  (Appendix 
A. 6),  F-5/T-38  (Appendix  B.l)  and  F- 111  (Appendix  B.5).  As  discussed  in  Section  2.2,  it  was 
the  F-l  1 1  accident  that  precipitated  the  Air  Force  to  revise  their  ASIP,  where  they  abandoned  the 
safe-life  approach  to  fatigue  design  and  incorporated  damage  tolerance  requirements. 

Many  fatigue  cracks  initiate  at  high  local  stress  concentrations  that  are  not  analytically  predicted 
during  initial  design,  but  are  later  revealed  during  component  or  full  scale  fatigue  testing.  Once 
identified,  these  locations  should  be  added  to  the  fracture-critical  locations  and  either  be 
modified  to  reduce  the  local  stress  concentration  or  monitored  by  inspections  based  on  the 
predicted  growth  of  the  maximum  probable  initial  flaw  that  may  exist  at  these  locations. 
However,  as  described  above,  in  the  early  1950s  (and  much  later  for  some  commercial  aircraft) 
fatigue  tests  were  generally  not  performed  prior  to  cracks  occurring  during  service  operation  and 
these  cracks  oftentimes  caused  catastrophic  failures.  This  was  the  case  for  all  of  the  accidents 
described  in  Appendices  A. 2  through  A. 5  plus  A.7  and  A. 8. 

Even  with  timely  full-scale  fatigue  tests,  the  loads  and  local  stress  distributions  are  sometimes 
not  adequately  represented  and  local  stress  concentrations  are  identified  by  cracks  or  failures  that 
occur  in  service.  For  example,  the  predicted  loads  and/or  load  spectrum  may  be  deficient  and 
thus  the  actual  loads  or  load  spectrum  may  not  be  represented  accurately  in  the  fatigue  test 
spectrum.  Two  examples  are  shown  in  Appendices  A. 6  and  A. 9.  In  these  examples,  the  failures 
resulted  from  more  severe  cyclic  load  spectra  than  predicted  combined  with  manufacturing 
and/or  service  induced  defects. 

While  catastrophic  failure  was  avoided  because  of  the  fail-safe  design  of  the  fuselage,  the 
specific  cause  of  the  Aer  Lingus-Irish  International  Airlines  Boeing  707-300  depressurization 
described  in  Appendix  A.  10  is  not  completely  understood.  The  707  fuselage  was  subjected  to  a 
hydro-fatigue  test;  however,  the  main  deck  cargo  door,  where  this  failure  occurred, 
apparently  was  not  included  in  the  original  707  hydro-fatigue  test.  The  fuselage  crack  and 
depressurization  was  precipitated  by  a  fatigue  failure  of  a  fuselage  frame  with  fatigue  cracking 
also  observed  in  adjacent  frames.  This  could  have  been  caused  either  by  1)  high  local  stresses  not 
accounted  for  in  the  analyses  and  not  included  in  the  hydro-fatigue  test  or  2)  manufacturing  or 
maintenance  damage.  Due  to  the  lack  of  a  specific  evidence  of  such  pre-existing  damage  the 
authors  have  included  it  in  the  high  local  stress  category. 

2.2  Manufacturing  and  Material  Defects 

There  are  a  myriad  of  possible  manufacturing  defects  that  can  become  initiation  sites  for  fatigue 
cracking.  Fastener  holes  have  been  particularly  prone  to  a  variety  of  drilling  defects  (e.g.,  burrs, 
tears,  score  marks,  double  drilled  holes,  bums,  nicks,  mislocated  holes,  short  edge  margins). 
Fastener  hole  defects  account  for  many  past  fatigue  cracking  incidents  and  failures  in  both 
military  and  commercial  aircraft.  However,  there  have  also  been  cracking  incidents  and  failures 
due  to  other  types  of  manufacturing  deficiencies  such  as  weld  defects  (e.g.,  shrinkage  cracks, 
tungsten  inclusions,  sharp  edged  porosity),  heat  treat  cracks,  scribe  marks,  sanding  marks, 
gouges,  dents,  grinding  burns,  arc  burns,  tool  marks,  scratches  and  machining  discrepancies. 
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In  addition,  a  number  of  different  material  defects  exist  that  can  and  have  become  initiation  sites 
for  fatigue  and/or  stress  corrosion  cracking.  These  include  inclusions,  laps  and  sharp  edged 
porosity  in  steel,  aluminum  and  titanium  forgings,  inclusions  and  sharp  edged  porosity  in  steel 
aluminum  and  titanium  castings,  potential  separation  of  large  grain  micro  structure  in  beta 
titanium,  delaminations  in  some  thick  aluminum  plate  and  composite  materials  and  hydrogen 
embrittlement  (blisters  and  cracks)  in  steel  forgings.  For  example,  it  was  a  forging  lap  that 
initiated  the  fatigue  crack  that  caused  the  crash  of  the  F-  111  at  Nellis  AFB  in  December  of  1969 
and  caused  the  USAF  to  re-examine  its  approach  to  fatigue  design  and  resulted  in  the 
development  of  damage  tolerance  requirements  (See  Accident/Incident  described  in  Appendix 
B.5  in  the  Compendium). 

Discussions  of  some  past  failures  that  initiated  at  manufacturing  and  material  defects  are 
provided  in  Appendix  B  (See  Table  3  for  a  listing  of  these  structural  failures).  Appendix  B 
includes  several  examples  where  defects  resulted  in  the  loss  of  the  aircraft.  It  also  includes 
several  examples  where  fail-safe  construction  prevented  an  element  failure  from  becoming  a 
catastrophic  loss  of  aircraft. 

Table  3.  Accidents/Incidents  Resulting  from  Manufacturing  and  Material  Defects 


Appendix 

Aircraft  Accident/Incident  Identified 

Time  Period 

B.l 

USAF  Northrop  F-5/T-38 

Apr  1970 

B.2 

USAF  Boeing  KC- 135 

1966-1977 

B.3 

USAF  Douglas  C-133 

Feb  1970 

B.4 

Curtis  Wright  X-19  VTOL 

Mid- 1965 

B.5 

USAF  General  Dynamics  F-  111 

Dec  1969 

A  USAF  study  of  12  fleets  of  aircraft  in  the  late  1960s  indicated  that  more  that  56%  of  all  fatigue 
cracks  initiated  from  pre-existing  manufacturing  and  material  defects  [16].  Recognizing  that  it 
would  be  impossible  to  predict  and  model  all  of  the  potential  types  of  manufacturing  defects,  the 
Air  Force  with  the  concurrence  of  an  AIA  committee  decided  (in  the  early  1970s)  to  assume  an 
initial  corner  flaw  (i.e.,  0.05-inch  comer  crack)  as  the  surrogate  for  all  the  possible  types  of 
fastener  hole  defects.  Unless  a  different  initial  flaw  size  could  be  justified,  this  flaw  size  was  then 
used  in  crack  growth  analyses  to  establish  safety  limits  and  inspection  requirements.  In  addition, 
an  initial  surface  flaw  was  selected  as  the  surrogate  for  possible  manufacturing  defects  away 
from  fastener  holes. 

While  there  has  been  continuing  pressure  over  the  years  to  relax  these  initial  USAF  flaw  size 
assumptions,  three  and  one-half  decades  of  success  is  strong  testimony  for  continuing  the  current 
approach.  Nevertheless,  the  success  of  a  slow  crack  growth  damage  tolerance  approach  depends 
on  in-service  inspections,  which  have  not  always  been  reliable,  and  does  not  protect  against 
larger  damage  sizes  that  occasionally  occur.  Therefore,  wherever  possible  new  aircraft  should  be 
designed  to  be  fail-safe. 
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Manufacturing  and  materials  defects  not  only  affect  aircraft  structures  but  also  other  critical 
subsystem  structural  components.  One  good  example  of  this  is  the  propulsion  system  structural 
failure  that  caused  the  United  Airlines  1989  DC- 10  accident  in  Sioux  City,  Iowa  (see  Appendix 
F.l).  The  root  cause  of  this  accident  was  a  hard  alpha  inclusion  in  a  titanium  forging  that 
initiated  a  crack  that  propagated  to  failure.  The  control  of  these  types  of  defects  has  generally 
been  through  improved  processing  (e.g.,  triple  vacuum  melt  and  hydrogen  removal  through 
baking)  and  factory  inspections.  The  maximum  probable  initial  flaw  size  used  in  the 
establishment  of  inspection  requirements  has  generally  been  based  on  inspection  capabilities. 
Inspection  capabilities  for  propulsion  systems  have  been  normally  determined  using  NDI 
probability  of  detection  (POD)  experiments,  rather  than  an  assumed  initial  flaw  size. 

In  the  case  of  the  F-  111,  it  became  apparent  that  it  was  not  possible  to  rely  on  NDI  to  detect  the 
very  small  flaws  that  could  result  in  another  catastrophic  failure  and  as  a  result  the  cold  proof  test 
was  used  to  establish  the  maximum  probable  initial  flaw  sizes  in  the  high  strength  D6AC  steel. 
This  test  was  initially  repeated  at  1500  hour  intervals  then  later  extended  to  3000  hours  based  on 
a  revised  assessment  of  aircraft  usage  and  predicted  crack  growth  rates. 

In  the  case  of  the  F-22  titanium  castings,  the  maximum  probable  initial  flaw  size  developed  for 
shell  and  hard  alpha  inclusions  was  much  larger  than  the  USAF  standard  assumed  initial  flaw 
sizes.  General  Moore  discussed  the  challenges  this  problem  represented  as  part  of  his  2007  ASIP 
Conference  presentation  [17].  Thus,  it  is  obviously  a  gross  oversimplification  to  say  that  the  Air 
Force  inspection  requirement  is  simply  one-half  the  time  for  the  traditionally  assumed  initial 
flaw  (e.g.,  the  0.05  inch  comer  crack)  to  grow  to  failure. 

2.3  Maintenance  Damage/Deficiencies 

The  same  type  of  defects  that  occur  during  the  initial  manufacturing  can  often  and  do  occur 
during  modifications,  maintenance  and  repair  activities.  In  fact,  the  likelihood  of  occurrence  may 
be  higher  than  it  is  in  the  factory  depending  upon  where  the  activities  take  place  and  the  skill  and 
training  of  the  mechanics  and  the  inspectors,  as  well  as  the  processes/procedures  used  to  ensure 
that  repairs  are  properly  designed  and  installed.  The  accidents/incidents  summarized  in  Table  4 
provide  examples  of  failures  due  to  service  induced  maintenance  damage. 

Table  4.  Accidents/Incidents  Resulting  from  Maintenance  Damage/Deficiencies 


Appendix 

Aircraft  Accident/Incident  Identified 

Time  Period 

C.l 

Beech  99  Commuter  Aircraft 

July  1990 

C.2 

Eastern  Airlines  Boeing  727 

Dec  1988 

C.3 

American  Airlines  McDonnell-Douglas  DC-10 

May  1979 

C.4 

Japan  Airlines  Boeing  747SR 

Aug  1985 

C.5 

China  Airlines  Boeing  747 

May  2002 

C.6 

Chalk  Airways  Grumman  Mallard  G-73 

Dec  2005 
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Appendices  C.l  and  C.2  describe  incidents  where  the  maintenance  damage  did  not  result  in  fatal 
accidents.  Appendix  C.l  involves  a  non-fail- safe  commuter  aircraft  where  the  fatigue  crack 
initiated  from  maintenance  damage  and  had  degraded  the  residual  strength  below  limit  load,  but 
the  crack  was  fortunately  discovered  in  a  routine  inspection  before  it  could  cause  failure. 
Appendix  C.2  is  an  example  where  the  maintenance  damage  caused  unstable  crack  propagation 
in  the  fuselage  of  an  airliner,  but  the  fail-safe  design  caused  crack  arrest  thus  avoiding  a  probable 
catastrophic  failure. 

Appendices  C.3  through  C.6  all  involve  fatal  accidents  resulting  from  maintenance  damage  and / 
or  deficiencies  due  to  non-compliance  with  the  Original  Equipment  Manufacturing  (OEM) 
Structural  Repair  Manual  (SRM).  The  DC-10  accident  (Appendix  C.3)  was  the  result  of  the 
airline  using  an  expedited  engine  removal  and  reinstallation  procedure  (not  recommended  by  the 
OEM)  that  inflicted  undetected  damage  to  the  engine  pylon.  While  fail- safety  had  been  a  major 
consideration  in  the  design  of  the  pylon,  it  was  not  fail-safe  for  the  particular  damage  that  caused 
this  accident.  The  Grumman  Mallard  accident  (Appendix  C.6)  was  another  non-fail-safe 
commuter  aircraft  where  the  fatigue  cracking  resulting  from  a  faulty  repair  in  the  wing  spar  cap. 
This  crack  went  undetected  thus  causing  the  failure  of  the  spar  and  loss  of  the  airplane.  Two  of 
the  six  fatal  accidents  (Appendices  C.4  and  C.5)  were  caused  by  uncontained  depressurization  of 
the  fuselages.  In  both  cases,  the  fail-safe  fuselage  designs  were  compromised  by  faulty  repairs  of 
previous  tail-strike  damage.  In  one  case  (Appendix  C.5)  the  repair  was  not  designed  and 
manufactured  in  compliance  with  the  OEM’s  SRM  and  in  the  other  case  (Appendix  C.4)  it  was 
not  manufactured  and  installed  in  accordance  with  the  design. 

To  improve  the  integrity  of  the  repairs  of  pressurized  fuselages  the  FAA  issued  an  Advisory 
Circular  on  December  14,  2000  [18].  This  was  followed  on  November  20,  2007  with  an 
Advisory  Circular  that  addressed  requirements  for  damage  tolerance  inspections  for  repairs  and 
alterations  [19]. 

2.4  Environmental  Damage 

2.4.1  Corrosion  and  Fretting 

In  most  cases  general  pitting  corrosion  is  visually  detected  and  repaired  before  safety  becomes  an 
issue.  However,  there  have  been  a  few  cases  in  the  past  where  corrosion  either  went  undetected 
or  was  ignored  and  resulted  in  catastrophic  accidents.  Table  5  identifies  two  accidents  resulting 
from  corrosion.  The  first  accident  occurred  in  October  1971,  when  a  British  European  Airlines 
Vickers  Vanguard  951  had  the  aft  pressure  bulkhead  (which  was  not  fail-safe)  fail  due  to 
corrosion.  This  is  briefly  described  in  Appendix  D.l.  The  second  accident  resulted  in  the  loss  of 
a  Far  East  Air  Transport  Boeing  737  in  1981  due  severe  corrosion.  It  appears  that  this  accident 
occurred  as  a  result  of  gross  negligence.  The  corrosion  was  so  severe  over  a  wide  area  of  the 
lower  fuselage  that  the  skin  thickness  was  reduced  by  over  70%  and  the  frames  were  severely 
corroded.  The  fail-safety  of  the  structure  was  destroyed  and  the  residual  strength  reduced  to 
below  the  design  operating  stress  levels.  See  Appendix  D.2. 
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Table  5.  Accidents/Incidents  Resulting  from  Environmental  Damage 


Appendix 

Aircraft  Accident/Incident  Identified 

Time  Period 

D.l 

British-European  Airlines  Vickers  Vanguard  951 

Oct  1971 

D.2 

Far  Eastern  Transport  Boeing  737 

Aug  1981 

Subsequent  to  the  introduction  of  DT  based  inspections  on  Air  Force  airplanes  in  the  1970s,  it 
was  expected  that  DT  inspections  would  detect  any  cracking  that  would  initiate  from  corrosion 
pits  or  due  to  fretting  before  the  cracks  become  critical.  It  seemed  inconceivable  that  cracks 
could  initiate  and  grow  to  a  critical  size  faster  than  a  pre-existing  0.05-inch  comer  flaw  or  a 
0.125-inch  deep  surface  flaw  could  reach  critical  size.  However,  this  assumption  needs  to  be 
carefully  re-examined  in  cases  where  one  is  counting  on  the  benefits  of  cold  working  or 
interference  fit  in  the  establishment  of  the  initial  DT  inspection. 

2.4.2  Stress  Corrosion  and  Corrosion  Fatigue 

Subcritical  crack  growth  in  aluminum  alloys  caused  by  a  combination  of  sustained  load  and  a 
stress  corrosion  mechanism  generally  occurs  in  the  plane  parallel  to  the  primary  applied  stresses 
(i.e.,  the  short  transverse  direction)  thus  very  large  cracks  occur  and  are  generally  detected  before 
structural  failure  occurs.  This  is  particularly  true  of  the  older  7000  series  aluminum  alloys  with 
T6  tempers,  which  typically  have  very  low  threshold  stress  intensity  factors  for  stress  corrosion 
cracking  (i.e.  measured  by  a  low  Kiscc)  in  the  short  transverse  direction.  The  Ki$cc  values  for 
aluminum  alloys  in  the  long  transverse  and  longitudinal  directions  are  usually  very  high  and  thus 
sustained  stress  crack  growth  is  not  a  problem  until  the  crack  approaches  its  critical  size.  Below 
the  threshold  for  stress  corrosion  cracking,  the  time  at  stress  or  the  cyclic  frequency  seems  to 
have  very  little  effect  on  fatigue  crack  growth  and  thus  corrosion/fatigue  should  not  be  an  issue 
in  this  regime.  In  other  words,  if  sustained  stress  crack  growth  does  not  occur  until  the  crack 
approaches  its  critical  size,  it  will  have  negligible  effect  on  total  crack  growth  life. 

On  the  other  hand,  in  high  strength  carbon  steel  alloys  the  Kiscc  values  can  be  very  low  in  all 
grain  directions  and  stress  corrosion  can  occur  even  in  relatively  benign  environments.  Both 
sustained  stress  crack  growth  and  corrosion/fatigue  are  important  issues  in  these  alloys.  High 
strength  carbon  steels  have  typically  been  used  in  landing  gear  components,  flap  tracks, 
pressurized  fuselage  ramp  hooks,  and  in  gears  and  fittings  in  rotorcraft  where  resistance  to  wear 
is  an  important  consideration.  Although  a  number  of  measures  are  generally  taken  to  preclude 
stress  corrosion  such  as  protective  coatings  (from  the  environment)  and  shot  peening  to  introduce 
favorable  compressive  residual  stresses,  numerous  component  failures  have  occurred. 

Fortunately  landing  gear  failures  have  generally  occurred  during  taxing  and  turning  and  have  not 
been  catastrophic.  Also,  most  of  the  in-flight  airplane  failures  have  involved  fail-safe 
components  and  thus  have  not  resulted  in  loss  of  the  aircraft.  On  the  other  hand,  there  have  been 
a  few  rotorcraft  failures,  which  were  catastrophic. 

Stress  corrosion  and  corrosion/fatigue  can  also  be  issues  in  some  titanium  alloys.  However, 
titanium  is  much  more  corrosion  resistant  than  steel  and  aluminums  in  normal  humid 
environments,  but  can  be  reactive  when  exposed  to  some  chemicals.  For  USAF  aircraft  designed 
during  the  1970s  and  beyond,  the  fracture  mechanics  design  approach  to  address  estimating 
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sustained  cracking  and  corrosion  fatigue  lives  was  to:  1)  utilize  testing  and  material  data  (da/dN 
vs.  AK)  to  ensure  that  the  aircraft  structure  is  designed  to  operate  in  the  appropriate  environment; 
and  2)  chose  materials  which  have  high  Kiscc  values.  A  discussion  of  this  approach  can  be 
found  in  Ref  20. 

2.5  Discrete  Source  Impact 

Survivability  and  vulnerability  requirements  and  the  Live  Fire  Test  Law  (10  U.S.C.  2366)  are 
resulting  in  a  higher  degree  of  redundancy  and  fail-safety  in  the  military’s  newer  aircraft  than  has 
existed  in  some  of  its  older  combat  aircraft.  The  need  to  be  able  to  sustain  armor  piercing 
incendiary  (API)  and  high  explosive  incendiary  (HEI)  hits  and  hydraulic  ram  effects  without  loss 
of  the  aircraft  is  forcing  the  use  of  high  fracture  toughness  materials  and  multiple  load  path 
structural  configurations.  This  tends  to  result  in  an  inherent  degree  of  fail-safety  in  new  aircraft 
designs  even  though  the  aircraft  are  certified  damage  tolerant  based  on  slow  crack  growth 
concepts.  For  the  F-22  this  is  discussed  in  some  detail  in  the  1995  NRC  report  entitled,  “Live 
Fire  Testing  of  the  F-22”  [21].  Other  than  battle  damage,  aircraft  structure  has  often  been 
subjected  to  many  other  types  of  discrete  source  impact  damage.  These  include  impacts  from 
dropped  tools,  collisions  with  ground  equipment,  uncontained  engine  failures,  bird  strike, 
runway  debris,  and  on  board  explosions. 

2.5.1  Ground  Equipment 

Since  damage  caused  by  discrete  source  impact  or  enemy  fire  is  generally  visually  detectable  by 
ground  personnel  or  in-flight  evident,  special  NDI  inspections  are  generally  not  necessary. 
However,  some  damage  resulting  from  impact  from  tools  or  ground  equipment  is  not  always 
immediately  evident.  This  may  be  particularly  true  of  structures  made  from  fiber  composites.  In 
such  cases,  catastrophic  failure  has  been  prevented  due  to  the  large  damage  capability  afforded 
by  fail-safe  design.  Two  examples  of  this  are  listed  in  Table  6  and  are  discussed  in  Appendix  E. 

Table  6.  Accidents/Incidents  Resulting  from  Impact  from  Ground  Equipment 


Appendix 

Aircraft  Accident/Incident  Identified 

Time  Period 

E.l 

Alaska  Airlines  McDonnell-Douglas  MD-80 

Dec  2005 

E.2 

Varig  Brazilian  Airlines  Boeing  747 

May  1988 

Probably  the  three  major  threats  for  non-combat  discrete  source  impact  are  uncontained  engine 
failures,  bird  strike  and  runway  debris.  These  are  discussed  separately  below  in  subsections 
2.5.2,  2.5.3  and  2.5.4,  respectively 

2.5.2  Uncontained  Engine  Failures 

Since  the  inception  of  commercial  jet  aircraft  more  than  five  decades  ago  there  have  been  many 
structural  failures  of  gas  turbine  engine  rotors  due  to  many  causes  such  as  foreign  object  damage 
(FOD),  manufacturing  defects,  material  defects,  design  errors  and  environmental  damage. 
Fatigue  crack  growth  often  occurs  prior  to  the  actual  component  failures. 
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Probably  one  of  the  most  comprehensive  studies  of  aircraft  gas  turbine  engine  rotor  failures  in 
United  States  commercial  aviation  was  performed  by  Galaxy  Scientific  Corporation  in 
conjunction  with  the  FAA  Technical  Center  in  Atlantic  City,  N  J.  This  study  is  reported  in  the 
FAA  report;  AD-A256-045  [22]  dated  June  1992  and  is  entitled,  “Statistics  on  Gas  Turbine 
Engine  Rotor  Failures  that  Occurred  in  U.S.  Commercial  Aviation  during  1989”.  The  statistics 
were  based  on  data  reported  in  FAA  Service  Difficulty  Reports  (SDR)  and  in  the 
Accident/Incident  Data  System  (AIDS)  and  concentrated  on  a  detailed  evaluation  of  1989  data, 
however,  it  also  reported  on  uncontained  engine  rotor  failures  over  the  27-  year  period  from  1963 
through  1989. 

In  1989  there  were  435  gas  turbine  engine  rotor  failures  reported  in  U.S.  commercial  aviation. 
Rotor  fragments  were  generated  in  156  of  these  failures  and  of  these  24  were  uncontained.  An 
uncontained  rotor  failure  is  defined  as  a  rotor  failure  that  produces  fragments  which  penetrate 
and  escape  the  confines  of  the  engine  casing  and  which  could  inflict  damage  on  aircraft  structure, 
systems  and/or  personnel.  Of  these  24  uncontained  failures,  18  involved  blade  fragments  and  6 
involved  disk  fragments.  Figure  1  shows  the  distribution  of  uncontained  engine  rotor  failure  for 
the  years  1963  through  1989. 
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CALBOAR  YEARS 
■  SDR  □  AOS 

Figure  1:  Uncontained  Rotor  Statistics  (1963-1989)  [22] 


15 


It  should  be  noted  that,  prior  to  1988,  the  data  in  Figure  1  include  only  the  uncontained  rotor 
failures  that  were  reported  in  SDRs  and  not  from  AIDS,  so  those  earlier  years  may  under 
estimate  the  number  of  failures.  In  total  the  figure  shows  about  500  uncontained  failures  in  the 
U.S.  over  the  27-year  period. 

Although  fragments  from  uncontained  rotor  failures  have  inflicted  serious  damage  to  commercial 
(and  military)  aircraft  structures,  it  has  been  relatively  rare  that  the  damage  has  resulted  in  loss  of 
commercial  aircraft  and/or  loss  of  life.  This  can  be  directly  attributed  to  the  decision  made  in  the 
early  1950s  by  the  large  US  commercial  airplane  manufacturers  (i.e.,  Boeing,  Douglas  and 
Lockheed)  to  design  their  structures  to  be  fail-safe  and  later  by  the  CAB  to  include  the  fail-safe 
option  in  the  Civil  Aviation  Requirements  (CAR). 

Table  7  summarizes  a  number  of  aircraft  accidents/incidents  resulting  from  uncontained  engine 
failures  and  the  types  of  airframe  damage  that  are  created  during  such  an  event.  Detailed 
discussion  of  these  accidents/incidents  can  be  found  in  the  corresponding  Appendix  F. 

Table  7.  Accidents/Incidents  Resulting  from  Uncontained  Engine  Failures 


Appendix 

Aircraft  Accident/Incident  Identified 

Time  Period 

F.l 

United  Airlines  McDonnell-Douglas  DC-10 

Jul  1989 

F.2 

National  Airlines  McDonnell-Douglas  DC-10 

Nov  1973 

F.3 

Air  France  Airlines  Boeing  747 

May  1971 

F.4 

UTA  Boeing  747 

Jan  1985 

F.5 

Delta  Airlines  McDonnell-Douglas  MD-88 

Jul  1996 

F.6 

Mesa  Airlines  Bombardier  Regional  Jet  CRJ  200 

Jan  2007 

F.7 

American  Airlines  Boeing  767 

Jun  2006 

One  example  of  a  1989  uncontained  engine  failure  that  did  result  in  the  loss  of  the  aircraft  was 
the  United  DC- 10  accident  in  Sioux  City,  Iowa.  While  the  airframe  structural  damage  did  not 
directly  result  in  the  accident,  an  engine  disk  fragment  cut  through  an  8-inch  wide  passage 
containing  hydraulic  lines  for  the  three  redundant  hydraulic  systems.  It  cut  all  three  lines 
draining  the  hydraulic  fluid  and  causing  loss  of  the  airplane  control  systems.  The  crew  had  to  try 
and  control  the  airplane  by  varying  engine  thrust  between  the  two  wing  mounted  engines,  but 
were  unable  to  prevent  the  crash  landing.  Further  detail  as  to  the  cause  of  this  accident  is  briefly 
discussed  in  Appendix  F.l. 

Appendices  F.2  through  F.6  provide  several  examples  of  where  the  structural  fail-safety  was  able 
to  prevent  loss  of  the  aircraft.  Appendix  F.7  shows  an  uncontained  rotor  failure  where  both 
engines  were  disabled  on  a  Boeing  767  during  a  ground  run. 
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2.5.3  Bird  Strikes 


It  has  been  recognized  for  many  years  that  aircraft  collision  with  birds  as  well  as  other  types  of 
wildlife  (e.g.,  deer  on  runways)  can  result  in  damage  to  aircraft  and  in  some  instances  pose  a 
threat  to  structural  safety.  The  FAA  has  established  bird  strike  structural  design  requirements  and 
in  1991  joined  with  DOD  and  the  Department  of  Agriculture  to  form  the  “Bird  Strike  Committee 
USA”  to  collect  bird  strike  data,  and  facilitate  information  exchange  between  the  various 
stakeholders. 

The  design  requirements  for  Part  25  transport  aircraft  are  specified  in  the  CFRs.  The  design 
requirements  are  that  the  aircraft  must  be  able  to  safely  complete  the  flight  after  an  8  pound  bird 
strikes  the  empennage  or  a  4  pound  bird  strikes  anywhere  else  on  the  airplane  (e.g.,  the  fuselage 
or  wings)  at  the  design  cruise  speed.  It  also  says  that  the  windshield  must  be  able  to  withstand 
the  impact  of  a  4-pound  bird  without  penetration  at  the  design  cruise  speed.  Nevertheless,  aircraft 
occasionally  encounter  larger  birds  and  very  often  encounter  smaller  birds. 

The  Joint  Service  Specification  Guide  JSSG-2006,  Aircraft  Structures  [23],  provides  an 
opportunity  to  define  design  requirements  for  bird  strikes  (as  bird  FOD)  in  Section  3.2.24.1  as 
well  as  for  verification  requirements  in  Section  4.2.24.1;  however,  tailoring  necessitates  that  bird 
sizes  and  aircraft  speed  be  chosen  consistent  with  the  aircraft  missions.  The  JSSG  document 
provides  rational,  guidance,  lessons-leamed,  and  instructions  for  bird  strikes  in  Appendix  A 
section  A. 3. 2. 24  [23].  In  Appendix  A,  the  guidance  is  applicable  to  any  type  of  FOD  including 
that  due  to  bird  strikes  and  states  that  “The  maximum  acceptable  frequency  of  loss  of  the  air 

vehicle  or  the  incapacitation  of  the  crew  due  to  FOD  impact  is  1  x  10"7  per  flight.”  Figure  8  in 
Appendix  A  of  JSSG-2006  provides  a  graphical  summary  of  the  relative  percentages  of  bird 
strikes  as  a  function  of  aircraft  structural  component. 

The  Bird  Strike  Committee  (BSC)  USA  reported  7500  bird  strikes  with  US  civil  aircraft  in  2007 

[24]  and  the  Air  Force  reported  5,000  with  USAF  aircraft  in  2006  [24].  In  addition  the  BSC 
estimated  that  80%  of  the  strikes  to  civil  aircraft  go  unreported.  The  BSC  also  reported  that 
during  the  15  year  period  ending  in  2006  the  cost  to  civil  aviation  was  over  $600  million  per 
year,  there  were  more  than  30  incidents  necessitating  emergency  landings  and  since  1988,  219 
people  have  been  killed  worldwide  as  a  result  of  bird  strikes. 

From  FY1985  to  2007,  there  has  been  approximately  3300  wildlife  strikes  on  USAF  aircraft  in 
the  United  States  annually,  and  over  this  period  the  number  has  been  increasing  (in  FY2007  4780 
wildlife  strikes  occurred)  [25].  From  FY1973  to  FY2007  (a  35  year  time  period),  the  USAF 
Safety  Center  recorded  42  aircraft  destroyed  by  bird  strikes,  an  average  of  just  over  one  a  year 

[25] , 

In  a  2003  report  [26],  John  Thorpe,  the  honorary  chairman  of  the  International  Bird  Strike 
Committee  (IBSC),  noted  that  the  major  bird  strike  threat  to  airliners  and  executive  jets  has  been 
bird  ingestion  in  the  engines.  Bird  impacts  on  the  windshields  and  the  airframes  have  been  lesser 
threats.  On  the  other  hand,  for  general  aviation  airplanes  and  helicopters  accident  rates  are  higher 
and  bird  impact  on  windshields  and  airframes  were  the  major  threats.  He  surmised  that  this  was 
due  to  the  fact  that  these  types  of  aircraft  operate  at  lower  altitudes  (i.e.  higher  density  of  birds) 
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and  the  fact  that  these  aircraft  are  usually  designed  and  built  to  lower  structural  standards  than 
the  large  transport  aircraft.  He  also  pointed  out  that  fatal  accidents  of  jet  airliners  as  a  result  of 
bird  strikes  are  extremely  rare.  He  noted  that  up  to  2003  there  had  only  been  one  fatal  accident  of 
a  jet-powered  airliner  in  over  one  billion  flying  hours.  This  was  the  Ethiopian  Airlines  Boeing 
737  that  crash  landed  near  Bahar  Dar,  Ethiopia  in  1988  due  to  loss  of  propulsion.  This  aircraft 
encountered  a  flock  of  pigeons  shortly  after  takeoff  and  ingested  birds  in  both  engines  causing 
the  engines  to  surge  and  then  lose  power.  The  airplane  was  forced  to  make  a  wheels-up  landing 
in  a  field  a  few  miles  from  the  airport.  The  airplane  caught  fire  on  impact  and  35  of  the  104 
persons  on  board  died. 

While  there  has  only  been  this  one  fatal  bird  strike  accident  of  a  jet  airliner  through  2002,  the 
IBSC  stated  that  there  have  been  two  other  fatal  propeller  airliner  accidents  resulting  from  bird 
ingestion  in  the  engines  and  one  resulting  from  a  bird  strike  on  the  airframe.  Also,  there  have 
been  several  jet  airliner  bird  strike  accidents  where  the  airplane  was  destroyed  but  there  were  no 
fatalities  and  there  have  been  numerous  aircraft  that  have  been  damaged  by  bird  strike  (to 
engines,  airframe  and/or  windshields),  but  have  been  repairable. 

The  commercial  airline  accident  attributed  to  bird  strike  that  had  the  most  fatalities  was  a 
turboprop;  an  Eastern  Airline  Lockheed  Electra.  On  October  4,  1960,  the  Electra  plunged  into 
Boston  Harbor  shortly  after  taking  off  from  Logan  Airport,  killing  all  but  10  of  the  72  persons 
aboard.  The  presence  of  many  dead  birds  on  the  Logan  runway  indicated  that  the  accident  might 
have  been  caused  by  ingestion  of  birds  into  the  aircraft’s  engines.  Subsequent  investigations 
provided  evidence  that  Starlings  were  ingested  in  the  No.  1,  2  and  4  engines.  The  No.  1  engine 
shut  down  and  the  No.  2  and  4  engines  had  intermittent  loss  of  power.  This  caused  the  aircraft  to 
lose  speed,  stall  and  dive  into  the  harbor. 

The  fatal  propeller  airliner  accident  due  to  bird  strike  on  the  airframe  was  a  United  Airlines 
Vickers  Viscount.  This  accident  is  noteworthy  in  that  it  had  a  direct  impact  on  regulatory  design 
requirements.  As  reported  by  the  NTSB,  on  November  23,  1962,  this  aircraft  was  struck  by 
whistling  swans  while  cruising  at  6,000  feet  on  a  flight  between  New  York  and  Washington.  A 
swan  struck  the  leading  edge  of  the  left  horizontal  tail  and  exited  through  the  rear  elevator 
surface  causing  the  complete  separation  of  the  left  horizontal  tail  and  loss  of  control  of  the 
aircraft.  The  airplane  crashed  and  none  of  the  17  persons  on  board  survived.  It  was  this  accident 
that  resulted  in  the  “eight  pound  bird  strike  design  requirement”  for  tail  surfaces  on  transport 
aircraft. 

In  addition  to  the  non-fatal  U.S.  Airlines  Flight  1549  (Airbus  A320)  that  crash  landed  in  the 
Hudson  river  on  January  15,  2009  after  ingesting  geese  in  both  engines,  there  have  been  several 
other  non-fatal  accidents  of  jet  airliners  that  resulted  in  the  total  loss  of  the  aircraft.  These 
include  a  McDonnell  Douglas  DC-10  in  New  York  in  1975,  a  Boeing  737  in  Belgium  in  1978 
and  an  Airbus  A300  in  India  in  1986.  All  resulted  from  bird  ingestion  in  the  engines. 

Three  examples  of  commercial  and  military  transport  aircraft  that  have  survived  significant  bird 
strike  damage  without  loss  of  the  aircraft  or  any  fatalities  are  listed  in  Table  8  and  briefly 
described  in  Appendix  G. 
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Table  8.  Accidents/Incidents  Resulting  from  Bird  Strikes 


Appendix 

Aircraft  Accident/Incident  Identified 

Time  Period 

G.l 

Delta  Airlines  McDonnell-Douglas  MD-88 

Feb  2008 

G.2 

American  Airlines  Boeing  767 

Apr  2001 

G.3 

USAF  Lockheed  C-130 

Aug  2005 

Compliance  with  the  FAR  bird  strike  design  criteria  and  the  OEM’s  fail-safe  design 
requirements  has  significantly  enhanced  the  bird  strike  resistance  of  transport  aircraft.  It  is 
doubtful  that  additional  structural  design  requirements  to  further  improve  bird  strike  resistance  of 
transport  aircraft  are  either  necessary  or  justified.  Improving  the  resistance  of  the  smaller  aircraft 
and  helicopters  to  withstand  bird  strikes  seems  desirable. 

2.5.4  Runway  Debris 

The  most  serious  accident  that  resulted  from  runway  debris  occurred  to  the  Concorde  supersonic 
transport  aircraft,  which  was  developed  to  provide  rapid  air  transportation  between  continents. 
The  accident  resulted  from  runway  debris  that  caused  a  tire  to  destruct/disintegrate  and  a  major 
tire  part  impacted  and  damaged  the  integral  fuel  tank  under  the  left  wing.  The  impact  not  only 
caused  a  local  penetration  but  also  resulted  in  hammer  shock  damage  to  the  fuel  tank,  resulting  in 
further  structural  damage  to  the  airframe.  Table  9  lists  the  appendix  (H.l)  that  summarizes  the 
accident  and  its  causes. 

While  FOD,  such  as  resulted  in  the  Concorde  accident,  does  periodically  cause  airframe 
structural  damage  as  described  by  a  presentation  by  Delta  Airlines  [27],  it  is  more  frequently  a 
serious  worry  for  engine  damage.  Airports  and  military  bases  have  FOD  prevention  activities 
that  effectively  reduce  the  potential  for  aircraft  and  engine  damage.  These  activities  are  focused 
on  clearing  runways  of  debris  before  aircraft  flights  start  using  the  runway.  However,  based  on 
the  runway  debris  that  has  been  found  embedded  in  aircraft  tires,  relatively  large  pieces  of  debris 
(bolts,  tie  down  anchors,  pieces  of  tire,  etc.)  could  be  flung  into  the  airframe  if  the  tire 
disintegrates  and  releases  the  embedded  debris.  This  threat  is  largely  mitigated  to  ensure  safety 
by  incorporating  fail-safe  concepts  into  those  aircraft  structural  zones  likely  to  experience  FOD. 

Table  9.  Accidents/Incidents  Resulting  from  Runway  Debris 


Appendix 

Aircraft  Accident/Incident  Identified 

Time  Period 

H.l 

Air  France  Concorde 

Jul 2000 
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2.6  Explosive/  Ballistic  Penetration  of  the  Airframe 

The  military  has  long  considered  the  threats  associated  with  ground  based  weapon 
systems/ground  fire  and  have  design  and  test  procedures  in  place  to  ensure  that  ballistic 
penetrations  do  not  result  in  the  immediate  loss  of  aircraft.  Typically,  to  ensure  aircraft  safety, 
the  areas  of  the  aircraft  subject  to  the  ballistic  threat  are  designed  to  be  fail-safe.  This  fail-safe 
structural  redundancy  is  verified  by  testing  as  described  in  the  beginning  of  Section  2.5. 

Over  the  years  there  have  been  a  number  of  civil  aircraft  lost  as  a  result  of  explosive  penetration 
of  missile  warheads  and  on-board  improvised  explosive  devices  (IEDs)  as  a  result  of  terrorist 
acts.  For  example,  between  1978  and  1999  more  than  40  civilian  aircraft  were  hit  by  shoulder- 
fired  missiles  (e.g.,  the  Soviet  SA-7).  While  more  than  half  of  the  aircraft  (i.e.,  about  25)  crashed, 
some  were  able  to  sustain  the  damage  inflicted  due  to  fail-safe  structural  design  and  land  safely. 
World  wide  there  were  about  600  deaths  as  a  result  of  these  crashes.  During  approximately  the 
same  time  period  (i.e.,  1971  and  1996)  there  were  42  in-flight  IED  attacks  and  19  on-ground  IED 
attacks.  Of  the  42  in-flight  attacks  there  were  25  aircraft  losses  and  17  survived.  Of  the  61 
attacks  there  were  40  aircraft  losses  and  21  were  repairable.  The  most  notable  of  the  IED  attacks 
was  the  loss  of  Pan  American  Airlines  Boeing  747  (Flight  No.  103)  over  Scotland  in  1988. 

While  the  military  have  developed  countermeasures  that  can  defeat  shoulder-fired  missiles,  the 
airlines  consider  such  countermeasures  to  be  uneconomical.  Consequently,  commercial  airliners 
remain  virtually  defenseless  against  this  threat.  It  appears  that  the  most  effective  defense  to  date 
has  been  for  government  and  law  enforcement  agencies  to  keep  the  missiles  out  of  the  hands  of 
potential  terrorists.  Economically  viable  countermeasures  may  still  be  an  option  in  the  future. 
With  regard  to  protecting  against  IEDs,  a  2001  British  Civil  Aviation  Authority  (BCAA)  study 
concluded  that  the  threats  cannot  be  eliminated  but  may  be  minimized  through  rigid  security  and 
the  use  of  hardened  baggage  containers,  protective  liners  for  the  fuselage  skin,  and  possible 
further  improvements  in  the  fail-safe  structural  design  [28]. 

In  addition  to  explosive  penetrations  of  the  airframe  from  terrorist  acts  there  have  been  a  few 
accidents  and  incidents  caused  by  unintentional  explosions.  The  most  notable  was  the  1996 
TWA  800  accident,  where  fuel  vapors  in  the  center  fuel  tank  of  the  Boeing  747  were  ignited 
from  an  electrical  short  and  the  tank  exploded  in  flight  killing  all  the  passengers  and  crew.  Two 
other  explosions  of  fuel  tanks  have  occurred  on  Boeing  737  aircraft  during  ground  operations. 
The  most  recent  occurred  on  March  3,  2001  when  a  Thai  Boeing  737-400  was  destroyed  by  fire 
on  the  apron  at  Bangkok  Airport.  Only  the  crew  was  aboard  at  the  time,  one  of  which  was  killed. 
The  other  occurred  in  1990  and  was  a  Boeing  737-300  operated  by  Philippine  Airlines. 

Obviously  these  failures  are  not  the  result  of  inadequate  structural  design  or  structural 
maintenance  and  the  structure  cannot  be  expected  to  survive  such  events. 

However,  there  was  a  recent  unintentional  explosion  that  occurred  on  a  Qantas  Airline  747  (See 
Table  10)  where  the  large  damage  fail-safe  structural  design  performed  exactly  as  anticipated 
and  the  plane  landed  safely  without  injury  to  the  passengers  or  crew.  While  the  accident 
investigation  is  still  ongoing,  the  initial  findings  indicate  that  the  failure  was  the  result  of  an 
oxygen  bottle  explosion.  This  incident  is  briefly  discussed  in  Appendix  1.1. 
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Table  10.  Accidents/Incidents  Resulting  from  Explosive  Penetrations 


Appendix 

Aircraft  Accident/Incident  Identified 

Time  Period 

1.1 

Qantas  Airlines  Boeing  747 

Jul  2008 

As  described  above,  several  airliners  were  lost  as  a  result  of  catastrophic  explosions  caused  by 
terrorist  acts  and  unintentionally  due  to  ignition  of  fuel  vapors  or  from  explosive  cargo. 
Obviously,  such  failures  are  not  the  result  of  inadequate  structural  design  or  maintenance  and  if 
the  explosive  force  is  of  sufficient  magnitude  fail-safe  design  may  not  be  able  to  contain  the 
damage  so  as  to  allow  a  safe  landing.  However,  fail-safe  design  has  in  some  cases  been  able  to 
contain  the  large  damage  caused  by  internal  explosions,  such  as  illustrated  by  the  recent  Qantas 
Airlines  incident  briefly  described  in  Appendix  1. 1 . 

2.7  Excessive  Operational  Loads 

An  early  recognized  threat  to  structural  safety  was  the  application  of  an  overload  that  exceeded 
the  aircraft  design  requirements;  such  overloads  induced  by  various  causes  have  resulted  in 
almost  immediate  catastrophic  failures.  Operational  loads  that  have  caused  structural  failures 
were  the  result  of  excessive  flight  and/or  ground  loads  (with  or  without  pilot  input  or  caused  by 
flight  control  system  errors),  excessive  gust  loads,  excessive  wind  shear  loads,  acoustic  loads, 
vibrational  instabilities  due  to  flutter,  transonic  panel  flutter,  tail  and/or  outer  wing  panel  buffet, 
“whirl  mode”  aeroelastic  phenomenon,  harmonic  oscillations,  or  other  possible  phenomenon  due 
to  aerodynamic  excitations  and  aeroelastic  responses. 

Babish  [29]  summarized  all  37  USAF  aircraft  losses  attributed  to  structural  failures  (as  defined 
by  the  USAF  Safety  Center)  that  have  occurred  to  since  1972.  Babish  determined  that  seven  of 
the  37  structural  failures  were  attributed  to  overloads  caused  by  pilot  error,  flight  control  system 
errors  or  to  a  combination  of  these  two  errors.  Figure  2  provides  a  summary  of  the  percentages 
of  catastrophic  aircraft  structural  failures  due  to  non-combat  causes  of  the  37  aircraft. 

While  excessive  operational  loads  can  be  and  have  been  important  threats  to  aircraft  structural 
safety  that  have  caused  both  military  and  commercial  accidents  (e.g.,  Lockheed  Electra,  C-141, 
F-15,  F-16,  B-52,  Lockheed  L-1011,  Airbus  A-320,  Douglas  DC-9,  Boeing  747,  etc.),  they  are 
beyond  the  scope  of  this  report.  Knowledge  of  the  operational  loads  and  the  potential  for 
excessive  operational  loads  of  is  a  key  part  of  the  structural  design  process.  It  is  expected  that  a 
future  report  will  address  the  threat  of  excessive  operational  loads. 
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Figure  2:  Percentages  Associated  with  Types  of  Causes  Associated  with  37  USAF 

Structural  Failures  [29] 

2.8  The  Onset  of  Widespread  Fatigue  Damage  (WFD) 

When  aircraft  reach  or  exceed  their  design  lives  as  adjusted  for  their  actual  usage,  the  number  of 
cracking  sites  in  fracture-critical  areas  continue  to  increase  (i.e.,  fatigue  cracks  initiate  at  the 
lower  stress  concentrations  and  less  severe  manufacturing  and  material  defects).  As  long  as  these 
cracks  can  be  detected  and  repaired  prior  to  reaching  their  critical  sizes,  the  integrity  of  slow 
crack  growth  designs  can  be  maintained;  however,  when  cracking  occurs  in  multiple  locations 
the  vulnerability  of  slow  crack  growth  designs  to  inspection  misses  will  increase  and  the  large 
damage  residual  strength  of  fail-safe  designs  can  be  lost.  When  cracking  occurs  in  adjacent  load 
paths  in  multiple  load  path  fail-safe  designs  (i.e.,  multiple  element  damage,  MED)  or  within  the 
load  path  in  crack  arrest  fail-safe  designs  (i.e.,  multiple  site  damage,  MSD),  the  large  damage 
residual  strength  can  be  lost. 

Loss  of  fail-safety  due  to  either  the  actual  onset  of  WFD  or  the  threat  of  WFD  has  been  a  serious 
structural  safety  issue  for  both  commercial  and  military  aircraft  for  many  years;  however,  there 
have  been  relatively  few  accidents  or  serious  incidents  that  are  directly  attributable  to  WFD.  This 
has  been  due  to  inspection,  repair,  modification,  component  replacement  and  actual  aircraft 
retirement  actions  that  have  been  taken  to  protect  structural  safety.  For  example,  in  the  late 
1960s,  the  onset  of  WFD  resulted  in  extensive  inspections  and  center  wing  box  replacements  in 
the  C-130B  and  early  E  models;  in  the  1970s  the  threat  of  WFD  resulted  in  the  initiation  of  a 
major  wing  modification  program  (i.e.,  the  H-Mod  Program)  for  the  C-5A;  in  the  1990s,  the 
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onset  of  WFD  in  the  E-8C  lower  wings,  led  to  the  replacement  of  affected  wing  panels  and  the 
onset  of  WFD  resulted  in  bonded  doubler  and  station  405  chordwise  joint  modifications  in  the  C- 
141  wings.  In  addition,  the  threat  of  WFD  in  the  wing  spanwise  splices  contributed  to  retiring  the 
C-141s  with  the  last  retirement  occurring  in  2006.  Also,  a  decision  to  replace  center  wing  boxes 
in  additional  C-130  aircraft  occurred  in  the  mid-2000s.  Additional  details  on  many  of  these 
actions  are  provided  in  Appendix  A  of  the  National  Materials  Advisory  Board  (NMAB)  report 
[30], 

Probably,  the  two  major  accidents  resulting  directly  from  the  WFD  threat  were  both  on  aircraft 
operating  under  the  FAA  Civil  Aircraft  Rules  and,  in  both  cases,  the  National  Transportation 
Safety  Board  (NTSB)  criticized  the  FAA  for  not  mandating  recommended  inspection  and 
maintenance  requirements.  These  accidents  were  the  1988  Aloha  Airlines  Boeing  737  accident 
and  the  2002  United  States  Forestry  Service  Fockheed  C-130A  accident.  These  two  accidents 
are  referenced  in  Table  1 1  and  described  in  the  Compendium  of  Accidents/Incidents  within 
Appendices  J.l  and  J.2,  respectively. 

Table  11.  Accidents/Incidents  Resulting  from  Widespread  Fatigue  Damage 


Appendix 

Aircraft  Accident/Incident  Identified 

Time  Period 

J.l 

Aloha  Airlines  Boeing  737-200 

Apr  1988 

J.2 

US  Forest  Service  C-130A 

Jun  2002 

As  aircraft  age,  inspection  reliability  becomes  ever  more  important  (i.e.,  safety  becomes  more 
and  more  dependent  on  finding  and  repairing  these  cracks)  and  the  inspection  burden  and 
airplane  down  times  can  overwhelm  the  operators  and  depots  and  jeopardize  operational 
readiness.  A  critical  issue  is  to  predict  when  this  is  likely  to  happen,  so  as  to  provide  adequate 
lead-time  to  prepare  and  obtain  funding  for  the  airplane  replacement  or  modifications.  The 
military  (USAF  and  US  Navy),  the  commercial  airlines  and  the  OEMs  have  NOT  done  a  good 
job  at  this. 

The  authors  believe  that  the  most  valuable  tool  for  predicting  the  onset  of  WFD  or  when 
durability-related  generalized  fatigue  cracking  is  likely  to  occur,  is  through  the  use  of  teardown 
inspections  of  both  full-scale  fatigue  test  articles  and  high  time/usage  airplanes.  Assuming  that 
the  crack  growth  models  have  been  validated  for  the  fracture-critical  areas,  the  findings  from 
these  teardown  inspections  can  be  used  to  analytically  develop  equivalent  initial  flaw  size  (EIFS) 
distributions.  These,  in  turn,  can  then  be  analytically  projected  forward  using  the  same  crack 
growth  models  and  the  actual  usage  spectra  to  predict  current  and  future  crack  distributions. 
These  crack  distributions  can  then  be  used  to  assess  the  risk  of  failure  at  any  specific  critical 
location  as  well  as  when  the  cracks  will  likely  be  of  sufficient  size  and  density  to  cause  loss  of 
fail-safety  or  when  the  inspection  system  required  to  protect  slow  crack  growth  designs  will  be 
completely  overwhelmed  and  safety  severely  jeopardized. 

The  key  to  having  a  believable  risk  analysis  depends  on  having  believable  crack  distributions, 
which  can  only  be  obtained  if  good  EIFS  data  are  obtained  from:  1)  full-scale  fatigue  test 
teardown  inspections  and  validated  crack  growth  models  for  the  structure  being  analyzed;  or,  2) 
teardown  inspections  of  actual  high  time/usage  aircraft  plus  validated  crack  growth  models. 
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2.9  Summary  of  Threats  and  Their  Associated  Mechanisms 


Table  12  summarizes  the  threats  to  structural  safety  and  their  associated  mechanisms  of  failure. 
Five  of  the  threats  typically  result  in  fatigue  failures  in  the  structure;  such  failures  have  been 
most  difficult  to  anticipate  primarily  due  to  the  large  number  of  variables  which  can  affect  the 
times  to  develop  critical  crack  sizes  in  the  operational  environment.  The  design  engineer  has 
utilized  fracture  mechanics  technologies  and  the  results  from  full-scale  fatigue  test  to  mitigate 
many  of  these  threats.  However,  as  aircraft  structures  are  used  beyond  their  initial  intended 
design  life  goals,  new  unidentified  cracking  sites  and  cracking  behaviors  are  again  leading  to 
new  catastrophic  structural  failures,  The  fatigue  mechanism  has  been  the  dominant  cause  for 
past  structural  accidents/incidents. 

Table  12.  Listing  of  Threats  and  Their  Associated  Mechanisms  of  Failure 


Section 

Threat 

Mechanism  of  Failure 

No.  of  Examples  in 
the  Compendium 

2.1 

High  Local  Stresses 

Fatigue 

11 

2.2 

Manufacturing/Material  Defects 

Fatigue 

5 

2.3 

Maintenance  Damage/Deficiencies 

Fatigue 

5 

2.4 

Environmental  Damage 

Corrosion  (material  loss) 

2 

2.5 

Impact  from  Ground  Equipment 

Fatigue 

2 

2.5 

Impact  due  to  Uncontained  Engine 
Failures 

Abrupt  Cracking 

7 

2.5 

Impact  due  to  Bird  Strikes 

Abrupt  Cracking 

3 

2.5 

Impact  due  to  Runway  Debris 

Abrupt  Cracking 

1 

2.6 

Explosive/Ballistic  Penetrations 

Abrupt  Cracking 

1 

2.7 

High  Operational  Loads 

Overload 

not  included  in  report 

2.8 

Widespread  Fatigue  Damage 

Fatigue 

2 

As  described  by  this  report,  the  various  threats  of  impact  can  result  in  either  immediate  or 
delayed  aircraft  structural  failures.  The  abrupt  cracking  failures,  caused  by  penetration  due  to 
impacts,  ballistic  damage  or  explosions,  are  threats  that  have  been  largely  addressed  by 
developing  structural  redundancies  and  fail-safe  concepts  into  the  airframe. 

While  most  structural  engineers  believe  that  the  problems  associated  with  high  operational  loads 
have  been  solved,  accidents/incidents  continue  to  be  observed  as  a  result  of  unusually  high 
operational  loads  caused  pilot  error  or  faulty  flight  control  systems.  Many  airplanes  have  been 
saved  by  the  1.5  factor  of  safety  used  to  establish  ultimate  design  loads. 

With  aircraft  operating  in  aggressive  environments,  the  potential  for  time-dependent  attack 
provides  opportunities  for  corrosion  attack  (material  loss  mechanism),  corrosion  fatigue, 
delamination/degradation  of  polymeric  composites,  and  debonding  of  adhesively  bonded  joints. 

While  the  time-dependent  attack  mechanisms  degrade  the  strength  over  time  in  service,  to  date 
they  have  been  responsible  for  a  limited  number  of  catastrophic  accidents.  With  proper 
maintenance,  and  scheduled  inspections  to  address  the  damage  that  results  from  environmental 
attack,  it  is  expected  that  this  threat  can  be  mitigated. 
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CHAPTER  3.0  -  MAINTAINING  AIRWORTHINESS 


As  discussed  in  Chapter  2,  cracks  represent  the  major  threat  to  maintaining  structural  safety 
(airworthiness).  Engineers  have  evolved  DT  structural  concepts  to  protect  structural  components 
from  these  threats.  Structures  are  normally  classified  in  one  of  two  design  categories:  fail-safe 
and  non-fail-safe. 

Fail-safe  structures  are  designed  to  contain  relatively  large,  visually-obvious  crack  damage  from 
causing  catastrophic  failure  for  a  defined  time  period.  Fail-safe  structures  generally  require  less 
in-service  maintenance  and  less  intense  inspections  than  those  of  the  non-fail-safe  variety. 
Determining  safe  periods  of  operations  between  inspections  require  an  understanding  of  the 
nucleating  fatigue  crack  populations  in  the  unfailed  parts  of  the  structure. 

Non-fail-safe  structures  can  be  designed  to  be  structurally  safe  using  the  slow  crack  growth 
design  concept  and  DT  based  inspections  to  prevent  a  crack,  if  present,  from  growing  to  a  size 
that  would  cause  catastrophic  fracture  of  the  component  and  thus  loss  of  the  aircraft.  Safe 
periods  of  operation  between  inspections  are  established  based  on  slow  crack  growth  behavior 
for  the  type  of  cracks  that  could  exist  in  the  structure. 

A  study  of  aging  aircraft  structures  reveals  that  despite  the  structural  category,  a  damage 
tolerance  design  concept  can  be  overcome  by  durability-related  fatigue  cracking.  This  chapter 
reviews  DT  structural  design  concepts  and  the  operational  limits  associated  with  each  damage 
tolerance  design  concept  utilized  to  control  the  effects  of  cracks  on  structures. 

As  further  discussed  below,  it  should  be  recognized  that  the  operational  limit  associated  with  a 
structural  component  is  not  necessarily  the  service  life  for  the  aircraft,  since  modifications  to  that 
component,  or  even  a  change  to  the  DT  design  concept,  can  extend  the  operational  limit  for  that 
component.  In  the  past,  owner/operators  have  invested  in  major  modifications  to  KC-135,  C-5A, 
E-8C,  C-130B/E,  A-10,  Boeing  737  and  other  aircraft,  to  maintain  airworthiness  while 
continuing  to  satisfy  mission  and  operational  requirements.  It  should  also  be  noted  that  the  Air 
Force  has  recently  been  establishing  Service  Fife  Fimits  (SEE)  for  their  aircraft,  which  define 
the  time  that  corrective  actions  such  as  modifications  or  component  replacements  are  required  to 
ensure  continued  airworthiness.  These  service  life  limits  should  be  considered  to  be  synonymous 
with  the  operational  limits  described  in  this  report  and  as  proposed  by  the  FAA  in  a  2006  Notice 
of  Proposed  Rule  Making  (NPRM)  to  be  mentioned  later.  They  are  not  absolute  limits  in  that 
they  can  be  extended  once  corrective  actions  have  been  implemented. 

The  eventual  aircraft  retirement  (i.e.,  service  life)  generally  involves  multiple  considerations  well 
beyond  just  structural  modification  requirements.  Note  however,  if  the  operational  limit  (or 
SEE)  for  a  structural  component  is  reached  and  no  action  is  taken,  structural  safety  is 
compromised  and  the  risks  of  catastrophic  aircraft  failures  are  high. 

To  maintain  structural  airworthiness,  the  Aircraft  Structural  Integrity  Program  described  in  MIL- 
STD-1530C  [31]  provides  overall  direction  and  dictates  when  action  must  be  taken  based  on  the 
risks  of  catastrophic  structural  failures.  Section  5. 5. 6. 3  of  MIL-STD-1530C  indicates  that: 
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1.  If  the  probability  of  catastrophic  aircraft  structural  failure  is  at  or  below  10"  per  flight,  the 
risk  is  considered  adequate  to  ensure  safety  for  long-term  military  operations. 

2.  If  the  probability  of  catastrophic  aircraft  structural  failure  exceeds  10"5  per  flight,  the  risk 
should  be  considered  unacceptable. 

3.  If  the  probability  of  failure  is  between  these  two  limits,  consideration  should  be  given  to 
mitigating  risk  through  inspection,  repair,  operational  restrictions,  modification,  or 
replacement. 

Thus,  the  operational  limit  for  any  type  of  USAF  structure  (fail-safe  or  non-fail-safe)  is  given  by 
item  2  above,  i.e.,  the  operational  limit  is  reached  when  the  single  flight  probability  of  failure 
reaches  10 5  per  flight.  Within  the  USAF,  the  10"5  per  flight  limit  can  only  be  exceeded  if  the 
service  component  executive  accepts  the  risk  of  continuing  flight  to  meet  mission  objectives. 
Recently  the  Air  Force  has  provided  additional  guidance  in  three  2008  Structures  Bulletins,  EN- 
SB-08-001,-002  and  -003  [11-13]  to  specifically  address  how  operational  limits  for  fail-safe  and 
non-fail-safe  (single  load-path)  structures  might  be  predicted.  As  discussed  in  these  Structures 
Bulletins,  the  approach  to  predicting  operational  limits,  and  the  validation  of  these  limits  will 
vary  depending  on  the  damage  tolerance  design  concept,  choice  of  materials  and  design  stress 
levels.  For  fail-safe  structure,  the  structural  operational  limits  are  reached  when  the  onset  of 
WFD  has  been  reached.  For  the  USAF  this  is  equivalent  to  reaching  the  upper  risk  limit,  10"5  per 
flight,  for  a  catastrophic  structural  failure  to  occur. 

There  is  a  coupling  between  the  MIL-STD-1530C  and  these  recent  Air  Force  Structural  Bulletins 
relative  to  establishing  operational  limits  for  aircraft  structure  to  ensure  maintaining 
airworthiness.  In  some  respects,  the  Structural  Bulletins  provide  guidance  in  the  absence  of 
current  information  within  the  Joint  Service  Specification  Guide,  JSSG-2006  [23] 1 . 

The  authors  also  note  that  in  2006,  the  FAA  issued  a  NPRM  [32]  on  Widespread  Fatigue 
Damage  (which  would  require  the  operators  to  establish  operational  limits).  As  of  August  2009, 
the  FAA  had  not  yet  released  a  final  rule  on  this  matter.  In  addition  to  predicting  when  structural 
safety  will  be  jeopardized  due  to  the  onset  of  WFD,  as  part  of  their  policy  change,  the  civilian 
aircraft  authorities  should  provide  guidance  on  the  validation  and  enforcement  of  operational 
limits  as  well  as  to  describe  the  actions  that  must  be  taken  to  protect  the  structural  safety  after  the 
limits  have  been  reached  and  until  the  airplane  structure  is  replaced  or  modified.. 

Generally,  the  predictions  of  the  onset  of  WFD  in  fail-safe  structure  are  heavily  guided  by  the 
results  of  the  FSFT  and  its  teardown  inspection.  Typically,  the  onset  of  WFD  is  reached  at  the 
end  of  the  durability  life  when  many  cracks  are  noticed  at  multiple  locations  in  the  structure.  For 
the  USAF,  MIL-STD-1530C  suggests  that  the  test  life  for  the  FSFT  be  extended  beyond  two 
design  service  lives  (based  on  the  design  spectrum),  because  the  extensive  cracking  associated 
with  the  onset  of  WFD  does  not  always  occur  within  the  two  lifetime  test  period.  So  unless  the 
time  when  the  onset  of  WFD  is  revealed  by  the  FSFT,  estimates  of  this  time  are  analytically 
made  based  on  EIFS  data  and  expected  crack  growth  behavior  collected  from  coupon  and  feature 


The  structural  bulletins  document  the  USAF  recommended  changes  to  Ref.  23;  before 
incorporating  such  information  into  Ref.  23,  coordination  with  the  US  Navy  will  be  required. 
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tests.  In  either  case,  the  onset  of  WFD  is  not  expected  to  occur  within  one  design  lifetime  of 
operation. 

Prior  to  approaching  the  estimate  of  the  onset  of  WFD  and  durability-related  fatigue  cracking,  it 
is  necessary  to  validate  the  estimate.  This  can  be  done  by:  1)  conducting  at  least  partial 
teardown  inspections  of  high  time/usage  aircraft;  2)  operating  a  robust  surveillance  program 
(suggested  by  section  5. 4. 3. 3  in  MIL-STD-1530C)  with  good  feedback  on  damage  found  to  the 
structures  community  (so  that  additional  focused  inspections  of  new  cracking  zones  can  be 
conducted  to  verify  the  general  nature  of  the  cracking);  and,  3)  possibly  conducting  an  additional 
FSFT  to  a  spectrum  that  more  closely  represents  that  which  the  fleet  is  flying.  If  it  turns  out  that 
the  time  estimate  for  the  onset  of  WFD  was  conservative,  additional  testing  and  analysis  is 
required.  A  number  of  questions  arise  subsequent  to  the  establishment  of  the  time  period  for  the 
onset  of  WFD.  These  are  documented  within  EN-SB-08-001  for  fail-safe  structure. 

Some  further  background  and  comments  are  provided  in  the  numbered  sections  below. 

3.1  Multiple  Load  Path  Fail-Safe  Structures 

With  the  multiple  load  path  fail-safe  structural  design  concept,  the  structure  must  retain  its 
required  residual  strength  for  a  safe  period  of  operational  usage  after  the  failure  of  a  load  path 
due  to  any  reason  (e.g.,  manufacturing  or  maintenance  induced  defect,  accidental  damage, 
environmental  damage  or  discrete  source  damage)  and  whenever  the  failure  might  occur.  The 
adjacent  load  path  or  paths  provide  the  second  line  of  defense  against  catastrophic  failure.  It  is 
this  adjacent  structure  that  then  controls  the  period  of  time  that  the  aircraft  is  fail-safe.  With  the 
eventual  occurrence  of  MED  the  residual  strength  of  the  adjacent  structure  will  be  degraded. 

The  key  is  to  predict  when  the  MED  (associated  with  durability-related  fatigue  cracking)  has 
progressed  to  the  point  such  that  it  is  likely  that  a  fatigue  crack  of  critical  size  under  the 
redistributed  loads  could  exist  in  the  adjacent  structure. 

An  acceptable  deterministic  approach  (based  on  initial  crack  sizes,  sized  as  durability  initial 
crack  sizes)  to  predicting  when  MED  could  occur  is  described  in  Structures  Bulletin  EN-SB-08- 
001  [11].  A  probabilistic  approach  (i.e.,  risk  analysis),  for  predicting  when  a  crack  of  critical 
size  (under  the  redistributed  loads)  could  exist  in  the  adjacent  structure,  is  also  acceptable 
providing  reliable  crack  population  data  are  available  to  conduct  such  an  analysis. 

The  questions  that  arise  if  the  fail-safe  operational  limit  is  reached  and  there  have  been  no 
failures  are: 

•  Has  the  fail-safe  capability  really  been  lost  by  virtue  of  MED  in  the  adjacent  structure? 

•  What  is  required  to  validate  whether  or  not  it  has  occurred? 

•  If  so,  how  can  the  safety  be  protected  until  the  airplane  structure  is  replaced  or  modified? 

•  And,  if  MED  has  not  yet  occurred,  how  can  the  operational  limit  be  extended?  Some  of 
the  approaches  to  answering  these  questions  are  given  below. 

It  may  require  at  least  a  partial  teardown  inspection  of  a  high  usage  airplane  to  determine 
whether  or  not  the  onset  of  MED  has  occurred  when  the  predicted  fail-safe  operational  limit  has 
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been  reached.  This  is  particularly  important  if  the  predicted  critical  crack  sizes  are  very  small  and 
thus  not  detectable  without  fastener  removal  and  non- visual  inspections. 

If  it  is  concluded  that  MED  does  exist,  the  short  term  alternatives  are:  1)  groundings;  2)  severe 
operational  restrictions  to  reduce  stress  levels  (and  thus  increase  the  predicted  critical  crack 
sizes)  and  slow  the  rate  of  crack  growth;  or,  3)  DT  slow  crack  growth  inspections  or  proof  testing 
(if  practical)  to  guard  against  failure  of  either  the  primary  or  the  adjacent  structure  load  paths 
until  the  structure  can  be  replaced  or  modified. 

If  it  is  concluded  that  MED  has  not  yet  occurred  a  careful  teardown  inspection  of  a  high  usage 
airplane  would  be  required  plus  a  reassessment  of  when  it  is  likely  to  occur.  In  addition, 
consideration  should  be  given  to  conducting  an  additional  FSFT  (or  at  least  a  component  test)  of 
an  existing  in-service  aircraft  to  a  spectrum  that  is  representative  of  the  aircraft  operational 
spectra.  Any  FSFT  should  be  followed  with  a  careful  teardown  inspection. 

3.2  Crack  Arrest  Fail-Safe  Structures 

Probably  the  best  examples  of  crack  arrest  fail-safe  structures  are  the  pressurized  fuselages  on 
commercial  and  military  derivative  transport  aircraft.  With  this  fail-safe  concept,  a  crack  in  a 
skin  panel  may  attain  critical  size  but  the  rapid  fracture  is  arrested  or  contained  because  of  design 
features  such  as  tear  straps  and/or  shear  tied  frames.  Ever  since  the  Comet  disasters  in  1954,  the 
aircraft  industry  has  strived  for  fail-safety  through  the  selection  of  tougher  materials,  stress  levels 
and  the  incorporation  of  design  features  that  provide  for  crack  arrest.  For  example,  a  historical 
summary  of  US  testing  methods  for  achieving  fail-safe  crack  arrest  structures  is  provided  in 
Appendix  K. 

The  threat  to  the  structural  safety  of  crack  arrest  fail-safe  structure  (as  well  as  to  multiple  load 
path  fail-safe  structure)  is  WFD.  While  the  specific  type  of  WFD  that  threatens  multiple  load 
paths  is  MED,  the  threat  to  crack  arrest  fail-safe  structure  is  MSD,  which  is  defined  as,  a  type  of 
WFD  characterized  by  the  simultaneous  presence  of  fatigue  cracks  in  the  same  structural 
element,  such  that  fatigue  cracks  may  coalesce  with  or  without  other  damage  leading  to  a  loss  of 
required  residual  strength.  The  prediction  of  the  fail-safe  operational  limit  for  crack  arrest  fail¬ 
safe  structure  thus  depends  on  predicting  when  the  MSD  will  reach  sufficient  density  and  size 
where  the  required  fail-safe  residual  strength  can  no  longer  be  maintained.  Again,  the  MSD 
event  occurs  as  a  result  of  numerous  nucleated  durability-related  fatigue  cracks. 

Some  experimental  results  reported  by  Jim  Maclin,  in  a  1991  Boeing  Commercial  Airplane 
Group  paper  [33]  provided  evidence  of  the  significant  effect  that  MSD  has  on  fail-safe  residual 
strength.  These  test  results  from  mechanically  fastened  aluminum  panels  have  shown  that  very 
small  MSD  in  fastener  holes  (e.g.,  ~  0.02-inch  to  0.04-inch  cracks)  ahead  of  the  arrested  crack 
can  have  a  significant  effect  on  the  fail-safe  residual  strength  (e.g.,  a  20  to  30%  reduction  in 
residual  strength).  If  such  MSD  existed  in  a  pressurized  fuselage  and  the  design  two-bay-damage 
occurred  (due  to  whatever  reason),  it  would  be  very  unlikely  that  there  would  be  a  safe 
decompression.  Indeed  this  is  what  happened  when  the  1988  Aloha  Boeing  737  accident 
occurred.  In  the  Aloha  accident,  small  MSD  existed  in  several  bays  ahead  of  the  lead  crack  that 
had  formed  as  a  result  of  MSD  cracks  coalescing  together.  Because  of  the  MSD  that  existed 
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ahead  of  the  lead  crack,  the  lead  crack  did  not  arrest  at  the  two-bay-crack  size  and  a  large  portion 
of  the  upper  fuselage  was  blown  away,  as  shown  in  Appendix  J.l. 

Since  such  small  cracks  (e.g.,  -0.02-0. 04-inch)  can  cause  loss  of  fail-safety,  the  prediction  of  the 
onset  of  WFD  (or  MSD)  becomes  one  of  predicting  when  durability-related  crack  nucleation  will 
occur.  Unfortunately,  fatigue  nucleation  analyses  (regardless  of  the  life  prediction  methodology) 
are  notoriously  unreliable  for  predicting  when  this  will  occur.  The  best  measure  of  when  the 
onset  of  MSD  will  occur  is  from  crack  size  data  collected  from  the  teardown  inspection  of  the 
FSFT  article.  This  is  particularly  true  for  pressurized  fuselages,  since  the  pressure  cycle  is  the 
primary  fatigue  load  and  the  test  spectrum  generally  represents  the  actual  operational  spectrum 
quite  well.  However,  if  the  onset  is  to  be  quantified,  the  fatigue  test  duration  needs  to  be 
sufficiently  long  so  that  MSD  occurs.  If  it  does  not  occur  in  the  required  two-lifetime  durability 
test  then  one  can  be  quite  confident  that  the  fail-safe  operational  limit  is  greater  than  the  design 
lifetime. 

Not  all  MSD  situations  involve  small  cracks  interacting  with  a  large  crack.  For  the  C-130 
rainbow  fitting,  small  durability-related  fatigue  cracks  nucleated  in  individual  bolt-hole  nodes  of 
the  fitting.  The  rainbow  fitting  is  a  bolted  joint  which  attaches  the  outer  wing  structure  to  the 
center  wing.  When  a  bolt  hole  durability-related  fatigue  crack  grew  to  a  size  of  ~0.085-inch,  the 
crack  rapidly  extended  across  the  bolt  hole  node  (failing  the  node)  and  then  arrested  with  a  size  - 
2-inch  long.  The  small  durability-related  fatigue  cracks  challenged  NDI  capability,  but  2-inch 
cracks  could  easily  be  detected  with  existing  field  equipment.  The  real  challenge  to  protect 
airworthiness,  however,  was  to  ensure  that  no  simultaneous  bolt-hole  node  failures  existed  in  any 
set  of  three  adjacent  nodes  in  the  fitting.  Analysis  showed  that  at  least  three  simultaneous, 
adjacent  bolt-hole  node  failures  with  their  2-inch  long  cracks  were  required  to  reduce  the  level  of 
residual  strength  below  the  design  requirement.  In  this  MSD  case,  since  inspections  could  detect 
the  presence  of  the  2-inch  cracks  at  failed  bolt-hole  nodes,  it  was  possible  to  provide  an 
inspection  option  and  to  reduce  the  risks  of  catastrophic  failure  and  thus  allow  sufficient  time  to 
start  replacing  high  time  rainbow  fittings  throughout  the  force,  without  grounding  actions.  This 
MSD  case  involved  the  interactions  of  three  relatively  large  cracks  within  the  structural  element. 

For  structure  other  than  the  pressurized  fuselage  that  may  rely  on  crack  arrest  fail-safety  (e.g., 
wing  and  empennage  skin  and  stringer  panels),  the  teardown  inspection  of  the  FSFT  is  probably 
still  the  best  source  for  developing  the  predicted  fail-safe  operational  limits.  For  such  structure, 
the  MSD  cracks,  obtained  from  the  full-scale  fatigue  test  can  be  analytically  backtracked  to 
develop  an  EIFS  distribution.  One  can  then  analytically  predict  the  growth  of  this  distribution 
(using  the  same  crack  growth  model)  for  the  actual  usage  spectrum  and  perform  a  risk  analysis  to 
predict  when  the  MSD  will  be  of  sufficient  size  and  quantity  to  cause  the  fail-safe  residual 
strength  to  fall  below  the  required  level.  The  time,  when  the  fail-safe  residual  strength  falls 
below  the  required  level,  is  the  fail-safe  operational  limit. 

Validation  of  the  fail-safe  operational  limit  would  require  a  teardown  inspection  of  a  high  usage 
airplane  once  the  aircraft  is  approaching  the  predicted  limit.  If  there  is  no  evidence  of  MSD  at 
the  predicted  limit  then  extending  this  limit  would  probably  require  additional  FSFT  evidence. 
TOGAA  [34]  suggested  this  approach  in  discussions  of  the  FAR  25.571  Amendment  96,  which 
requires  that  there  shall  be  full-scale  fatigue  test  evidence  that  WFD  (MSD)  will  not  occur  within 
the  design  service  goal  (DSG).  Thus,  if  a  high  time/usage  aircraft  teardown  inspection  validated 
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the  presence  of  MSD  and  that  the  fail-safe  operational  limit  had  been  attained  (i.e.,  the  fail-safety 
had  been  jeopardized)  then  flight  restrictions  plus  slow-crack-growth  (DT)  inspections  could  be 
imposed  (as  an  interim  measure)  until  the  structure  is  modified,  replaced  or  the  airplane  retired. 
For  the  USAF,  it  is  necessary  that  the  risk  of  catastrophic  structural  failure  never  exceed  the  10"5 
per  flight  limit  established  by  MIL-STD-1530C. 

As  with  the  multiple  load  path  fail-safe  structure,  when  fail-safety  is  lost  in  crack  arrest  fail-safe 
structure,  one  can  attempt  to  manage  the  structure  with  slow  crack  growth  DT  based  inspections 
or  with  periodic  proof  testing  until  the  structure  is  modified  or  replaced.  If  neither  of  these 
options  can  be  applied,  the  airplane  should  be  grounded  and  the  structure  must  be  modified  or 
replaced  at  the  fail-safe  limit. 

3.3  Non-Fail-Safe  /  Single  Load  Path  Structures 

With  truly  single  load  path  structures,  there  is  no  second  line  of  defense  to  structural  element 
failure.  Catastrophic  failure  must  be  avoided  by  detecting  subcritical  cracks  before  they  reach 
their  critical  sizes  (i.e.,  the  first  and  only  line  of  defense).  While  the  assumed  (surrogate)  0.05- 
inch  initial  comer  crack  has  been  effective  in  protecting  against  rogue  manufacturing  defects  in 
metallic  structures,  single  load  path  structures  are  still  vulnerable  to  other  threats  that  fail-safe 
designs  can  protect  against.  While  defining  the  safe  operational  limits  for  fail-safe  designs  is 
relatively  straightforward,  it  is  more  difficult  to  define  a  specific  operational  limit  for  single  load 
path  structures. 

When  the  USAF  damage  tolerance  requirements  were  originally  developed  in  the  early  1970s,  it 
was  believed  that  the  DTbased  inspections  would  protect  single  load  path  structures  against 
rogue  flaws  (as  well  as  most  other  types  of  defects)  indefinitely.  As  the  airplane  got  older  and 
there  were  more  and  more  critical  areas  to  be  inspected,  and  there  was  more  and  more  durability 
related  cracking  in  these  critical  locations,  it  was  thought  that  the  economic  burden  associated 
with  all  of  the  inspections  and  repairs  would  eventually  force  major  modifications. 

Thus,  it  was  thought  that  inspections  and  modification  would  protect  the  structural  safety  while 
economics  and  readiness  would  dictate  the  service  life.  Obviously,  the  problem  with  this 
scenario  is  that  it  assumes  that:  1)  all  potential  critical  cracking  locations  are  identified;  2) 
adequate  inspection  approaches  are  designed  to  detect  cracks  at  these  critical  locations;  3)  the 
inspectors  are  adequately  trained  to  apply  the  necessary  NDI  methods  at  the  critical  locations,  4) 
all  the  required  inspections  will  be  performed  as  required;  5)  the  required  inspections  will 
reliably  detect  all  cracks  before  these  cracks  reached  their  critical  sizes;  and,  6)  that  the  depots 
have  the  resources  (budget  and  skilled  people)  to  address  the  increased  inspection  and  repair 
burden  in  a  timely  manner. 

As  discussed  in  a  2007  Aging  Aircraft  Conference  paper  [7],  these  assumptions  are  now  believed 
to  be  false.  In  fact,  the  poor  inspection  reliability  could  jeopardize  safety  well  before  the  onset  of 
cracking  events  at  multiple  inspection  locations.  For  a  single  load  path  element/component,  if 
the  inspection  reliability  is  poor  at  even  a  single  inspection  location,  that  is  experiencing 
frequently  occurring  cracks,  the  individual  inspection  location  crack  population  may  overwhelm 
the  inspection  capability.  Compounding  the  problem  is  that  some  military  aircraft  have  reached 
or  are  approaching  the  onset  of  durability  related  cracking  at  multiple  locations.  While  inspection 
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reliability  needs  to  be  improved  to  protect  against  early  failures,  operational  limits  need  to  be 
developed  and  enforced  so  as  to  help  minimize  the  risk  of  encountering  catastrophic  failures  as  a 
result  of  the  inspection  system  missing  a  significant  crack.  A  significant  crack  is  one  that  has  a 
size  that  is  large  enough  that  it  will  grow  to  failure  between  inspections. 

For  truly  single  load  path  structures,  the  issue  associated  with  establishing  operational  limits  for 
inspectable  structures  is  primarily  a  function  of  the  difficulties  associated  with  adequately 
performing  inspections  to  ensure  that  no  crack  in  the  structure  can  grow  to  its  critical  size  before 
the  next  inspection.  If  cracks  are  occurring  at  multiple  locations2  simultaneously  (a  type  of 
widespread  fatigue  damage),  the  inspection  system  [7]  can  be  severely  challenged  to  detect  any 
and  all  significant  cracks  that  may  be  present  at  locations  where  a  crack  could  cause  a 
catastrophic  failure  of  the  element/component/airframe. 

To  further  complicate  the-cracks-growing-simultaneously  at  multiple  locations  situation,  for  an 
aging  aircraft,  while  most  critical  locations  are  known  and  recognized,  as  a  result  either  from 
design  (analysis  and  testing)  experience  or  from  prior  in-service  cracking  experience,  not  all 
potential  critical  locations  show  themselves  until  an  accident  occurs.  (Typically,  such  accidents 
occur  after  the  structure  has  exceeded  its  demonstrated  fatigue  life,  i.e.,  exceeded  Vi  the 
equivalent  flight  hours  associated  with  the  full-scale  fatigue  test.) 

For  aging  single  load  path  structures,  the  occurrence  of  durability-related  fatigue  cracking 
constitutes  a  type  of  generalized  fatigue  damage  where  multiple  locations  are  simultaneously 
experiencing  durability-related  cracking.  The  cracks  at  these  multiple  locations  within  the 
structural  element  may  interact  or  not.  From  experience,  the  multiple  cracking  locations  in  truly 
single  load  path  structures  do  not  interact  with  each  other  and  do  not  influence  the  damage 
behavior  at  other  critical  locations  before  failure  occurs.  This  means  that  if  a  number  of 
simultaneous  cracking  locations  are  occurring,  each  cracking  location  could  separately  lead  to  a 
structural  element/component  failure  when  its  crack  reaches  critical  size.  For  some  non-fail-safe 
structures  with  multiple  load  paths,  however,  the  multiple  crack  locations  can  separately 
experience  MED  cracking  and  crack  location  interactions. 

The  need  exists  to  define  how  much  durability-related  fatigue  cracking  is  too  much  for  non-fail- 
safe  or  single  load  path  designs.  Determining  how  much  durability-related  fatigue  cracking  is  too 
much  can  likely  be  accomplished  by  performing  a  risk  assessment  on  the  cracking  behavior  at 
the  cracking  locations.  For  the  risk  assessment  to  be  believable,  it  is  essential  that  the  crack 
populations  be  quantified  (and  then  verified)  as  a  function  of  time. 

One  approach  to  establishing  the  element/component  operational  limit  would  be  to  determine  the 
times  when  each  cracking  location  reaches  the  USAF  upper  bound  limit  (10"5  per  flight).  The 
location  which  takes  the  lowest  time  to  reach  the  upper  bound  limit  would  be  used  to  establish 
the  structural  element’s  operational  limit.  If  alternate  inspection  techniques/approaches  can  be 
used  to  reduce  the  high  risks  associated  with  this  location,  or  if  modifications  or  element 
replacements  can  be  used  to  significantly  reduce  the  structural  airworthiness  risks,  then  the  time 


A  location  is  defined  as  a  separate  damage  tolerance  control  point,  i.e.,  if  more  than  one  crack  exists  in  the 
region,  then  each  crack  has  the  same  stress-intensity  factor,  same  stress,  same  crack  configuration,  same  local 
geometrical  configuration,  and  the  same  crack  growth  curve. 
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for  the  next  most  likely  cracking  location  to  reach  the  upper  bound  structural  risk  would  reset  the 
structural  element’s  operational  limit  to  this  later  time. 

Simultaneous  durability-related  fatigue  cracking  at  multiple  critical  sites  normally  starts 
occurring  when  nucleation  damage  (due  to  typical  material  and  manufacturing  defects)  at  the 
critical  sites  grows  cracks  that  are  large  enough  to  be  detected  during  in-service  teardown 
inspections  of  high  time/usage  aircraft.  Most  cracks  at  multiple  known  locations  may  be  caught 
by  the  inspection  system;  however,  it  is  possible  cracks  may  be  growing  at  a  number  of  unknown 
locations.  As  a  result  of  the  number  and  size  of  these  simultaneous  cracks  at  multiple  locations, 
some  significant  cracks  may  be  missed  by  the  inspection  system. 

The  time  when  a  state  of  generalized  cracking  (a  state  where  many  locations  are  simultaneously 
experiencing  durability-related  fatigue  cracking)  occurs  may  represent  an  absolute  upper  bound 
operational  limit  for  an  aging  single  load  path  structure  (or  non-fail-safe  structure).  It  should  be 
noted  that  this  onset  of  generalized  cracking  is  normally  shortened  when  other  in-service  damage 
mechanisms  are  operating,  e.g.,  corrosion  pitting,  fretting  damage,  etc.,  simultaneously  with 
fatigue  mechanisms. 

As  suggested  above,  surveillance  inspections  for  damage  in  an  aging  aircraft  are  an  important 
ASIP  activity  to  determine  the  presence  of  damage  in  zones:  1)  where  design  and  past  history  has 
indicated  such  damage  to  occur;  as  well  as  2)  that  have  not  previously  indicated  the  potential  for 
damage.  For  single  load  path  structure,  it  is  especially  important  that  the  early  detection  of 
damage  be  noted  in  all  zones  not  previously  identified  during  design  or  full-scale  fatigue  tests. 
The  surveillance  requirement  is  identified  in  MIL-STD-1530C  and  approaches  for  conducting 
surveillance  inspections,  and  for  recording,  storing  and  reporting  damage  in  aging  aircraft 
structures  is  presented  in  Ref  35.  Using  this  feedback  to  conduct  additional  focused  inspections 
at  new  crack  locations  will  reveal  the  extent  of  the  problem  and  help  dictate  approaches  that  can 
be  used  to  mitigate  structural  risks. 

In  addition  to  the  validation  approaches  used  for  fail-safe  structure,  for  non-fail-safe  structures, 
maintenance  feedback  that  provides  the  numbers,  size  and  location  of  cracks  can  be  used  to 
validate  structural  analysis  models  (damage  tolerance  models  and  risk  models). 
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CHAPTER  4.0  -  CONCLUDING  REMARKS 


This  report  has  defined  the  threats  to  aircraft  structural  safety  and  the  accidents/incidents  that 
characterize  the  effects  of  each  threat.  It  has  also  discussed  how  the  threats  have  influenced  the 
development  of  regulations/codes  and  standards  to  mitigate  the  threat  during  both  design  and 
operation. 

The  report  was  organized  so  that  the  tables  (2-11)  and  the  associated  Appendices  in  the 
Compendium  can  be  updated  as  new  accidents/incidents  are  written  up;  thus  the  report  becomes 
a  living  document  for  the  structural  integrity  community. 

The  report  cites  the  Aircraft  Structural  Integrity  Program  for  diminishing  the  failures  of  single 
load  path  aircraft  structures  (i.e.,  slow  crack  growth  design  concepts)  due  to  fatigue  and 
environmentally  assisted  cracking  caused  by  unanticipated  high  local  stress  concentrations, 
manufacturing,  material  and  maintenance  defects.  It  also  points  out  that  fail-safe  design  is 
required  to  protect  the  structural  safety  of  aircraft  against  large  damage  threats  (e.g.,  damage  due 
to  discrete  source  impact)  as  well  as  the  threats  that  can  result  in  fatigue  and/or  environmentally 
assisted  cracking.  Fail-safe  design  combined  with  damage  tolerance  analysis  and  tests  has  been 
the  primary  factor  responsible  for  protecting  the  structural  safety  of  both  civilian  and  military 
transport  aircraft. 

This  being  said,  the  report  points  out  that  both  fail-safe  and  slow  crack  growth  design  concepts 
can  be  defeated  by  durability-related  fatigue  cracking  and  with  the  aging  of  both  civilian  and 
military  aircraft  this  becomes  a  major  concern.  Durability-related  fatigue  cracking  manifests 
itself  in  the  literature  as  the  onset  of  WFD.  It  is  recommended  that  the  operational  limits  be 
developed  for  each  of  the  aircraft  structural  design  concepts  relative  to  the  onset  of-the  type  of 
WFD  (or  durability-related  fatigue  cracking)  that  defeats  the  structure’s  ability  to  carry  its 
residual  strength  requirement: 

■  Multiple  load  path  fail-safe  structure  is  defeated  by  the  onset  of  multiple  element  damage 

■  Crack  arrest  fail-safe  structure  is  defeated  by  the  onset  of  multiple  site  damage 

■  Single  load  path  structure  can  be  defeated  by  either  a  single  location  where  inspection 
capability  is  overwhelmed  or  by  the  onset  of  generalized  cracking,  where  durability- 
related  fatigue  cracking  is  simultaneously  occurring  at  multiple  (known  and  unknown) 
locations. 

While  the  operational  limit  for  fail-safe  structures  has  been  reasonably  accepted  by  the 
community  as  the  time  when  the  onset  of  WFD  occurs,  the  use  of  a  similar  durability-related 
fatigue  cracking  concept  for  single  load  path  structure  is  new. 

4.1  Recommendations 

•  The  US  Navy  should  be  given  the  opportunity  to  add  accidents/incidents  to  the 

Compendium  in  future  updates  of  the  report  to  improve  its  value  to  the  overall  military 
fixed  wing  community. 


33 


•  More  attention  must  be  given  to  determining  the  operational  limits  for  single  load  path 
structure. 

•  FAR  25.571  and  JSSG  2006  should  be  updated  to  include  more  information  that  clarifies 
the  conditions  establishing  operational  limits. 
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APPENDIX  A 

ACCIDENTS/INCIDENTS  RESULTING  FROM  UNANTICIPATED  HIGH 
LOCAL  STRESSES  (COMBINED  WITH  POSSIBLE  MANUFACTURING 

DEFECTS) 


Appendix  A.l 

BOAC  COMET  G-ALYP  &  G-ALYY 
Accident  Summarized  by 
Charles  F.  Tiffany 


Figure  Al:  BOAC  Comet  in  Flight 

Figure  Al.  illustrates  a  photo  of  a  Comet  in  flight;  the  Comet  was  the  first  jet  transport  to  enter 
scheduled  airline  service  in  1952.  Comet  1  (DH  106-1)  registration  number  G-ALYP  was  the 
first  jet  transport  to  enter  scheduled  airline  service  on  May  2,  1952.  On  January  19,  1954  after 
only  1,286  pressurized  flights  this  aircraft  suffered  an  explosive  decompression  failure  and 
crashed  in  the  Mediterranean  off  Elba. 

On  April  8,  1954  a  second  Comet  1,  registration  number  G-ALYY,  also  experienced  an 
explosive  decompression  after  only  903  flights  and  crashed  into  the  Mediterranean  off  Naples. 
These  failures  resulted  in  the  permanent  grounding  of  the  Comet  fleet  and  the  initiation  of  an 
intensive  investigation  as  to  the  cause  of  the  failures.  The  failures  were  unexpected  in  that  the 
fuselage  had  been  successfully  pressure  cycled  to  about  18,000  flights  without  a  problem  [Al]. 

Intensive  investigations  followed  including  the  recovery  and  close  examination  of  much  of  the 
G-ALYP  aircraft.  Approximately  70%  of  the  structure  of  G-ALYP  aircraft  was  recovered  and 
reassembled  in  Farnborough  as  shown  in  Figure  A2.  The  G-ALYY  aircraft  was  never 
recovered.  Investigations  revealed  that  the  failure  of  G-ALYP  originated  near  the  aft  automatic 
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direction  finding  (ADF)  window.  The  likely  scenario  of  aircraft  breakup  is  illustrated  in  Figure 
A3. 


'Roconsi'jctori'  of  G-ALYP  s  'uselago  anc  tail  aacmbly  at  the  Royal  Aircna'l  Esiab  stiment 
at  Fa’nbo’o-jgh  durng  the  nvoat  gat  on  of  the  G-ALYP  and  G-ALYY  acc  cents 


Figure  A2:  Photo  of  Comet  (G-ALYP)  Reconstruction  of  Fuselage  and  Tail  Units  at  Royal 
Aircraft  Establishment  at  Farnborough  during  the  Investigation  of  Accidents  [A2] 


According  to  Swift  [A3],  the  origin  was  believed  to  be  at  the  end  fastener  hole  at  a  frame  cut-out 
adjacent  to  the  ADF  window.  Swift  has  provided  a  detailed  analysis,  which  describes  the  loss  in 
residual  strength  with  crack  progression  and  the  reason  for  the  lack  of  crack  arrest  and  fail-safe 
capability  [A3-A5]. 


Figure  A3:  Uncontained  Running  Cracks  Led  to  Aircraft  Breakup.  Poor  Detail  Design  of 
Cutouts  Led  to  Running  Cracks  in  the  Highly  Stressed  Low  Toughness  Skin 


While  the  stress  levels  adjacent  to  this  ADF  window  as  well  as  adjacent  to  other  cut-outs  were 
high  (due  to  poor  detailed  design)  and  certainly  caused  early  crack  initiation,  this  by  itself 
doesn’t  explain  how  the  full-scale  cyclic  pressure  test  article  could  successfully  sustain  18,000 
pressure  cycles  and  the  two  Comet  airplanes  failed  at  1,286  and  903  pressure  cycles  when  also 
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subjected  to  high  stress  levels.  To  explain  this  requires  also  considering  the  effect  that 
manufacturing  quality  (i.e.,  manufacturing  defects)  has  on  fatigue  life  and  recognizing  that,  in 
low  fracture  toughness  materials,  small  defects  can  cause  very  wide  variations  in  life.  Unless  the 
test  article  contains  such  defects  in  the  high  stress  areas,  fatigue  cracks  may  not  initiate  until  very 
late  during  the  test. 

During  the  reconstruction  of  G-ALYP,  a  pre-existing  manufacturing  crack  or  tear  was  found  at 
the  edge  of  the  ADF  window  cut-out  (See  Figure  A4).  This  crack  had  been  stop-drilled,  which 
was  the  accepted  repair  practice  at  that  time.  Several  other  locations  in  this  aircraft  had  similar 
kinds  of  manufactured  cracks  or  tears  that  had  also  been  stop-drilled  in  the  factory  [A4] . 


-VI-3.  Crack  and  Drill  Hole  in  Reinforcing  Plate  at 

Starboard  Rear  Corner  of  Front  ADF  Aerial  Window 
Comet  G-ALYP 


Figure  A4:  Local  Area  that  Had  a  Stop-Drilled  Hole 


As  part  of  the  G-ALYP  investigation,  another  full-scale  hydro  (pressurization)  fatigue  test  was 
performed  on  a  retired  Comet  1  (G-ALYU)  until  failure  occurred.  This  article  failed  at  a  different 
location  (i.e.,  the  port-side  forward  escape  hatch  window)  due  to  fatigue  cracking  at  about  9,000 
simulated  flight  hours  (i.e.  3,057  pressure  cycles);  however,  to  the  author’s  knowledge  details  of 
the  manufacturing  quality  at  his  location  were  not  noted.  See  Figure  A. 5  for  details  of  the 
uncontained  cracking  that  occurred  after  cracks  rapidly  propagated  from  the  initiation  site  [A6] . 

In  the  early  1950s  when  this  airplane  was  being  designed  and  manufactured  there  was  no  specific 
emphasis  on  having  large  damage  capability  or  fail- safety  nor  had  either  analytical  or  empirical 
fail-safe  design  and  test  methods  been  developed.  Also,  fracture  mechanics  was  in  its  infancy 
and  there  was  insufficient  emphasis  on  using  tough  materials  with  reasonable  design  stress  levels 
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so  as  to  achieve  large  critical  crack  sizes.  If  the  structure  had  been  designed  to  be  fail-safe  to 
today’s  standards  initial  manufacturing  defects  could  have  been  tolerated  without  resulting  in 
catastrophic  failure.  Figures  illustrating  this  lack  of  crack  containment  capability  of  the  fuselage 
structure  (i.e.,  lack  of  fail-safety)  and  photographs  taken  as  part  of  the  failure  investigation  are 
shown  in  Figure  A5. 


Figure  A.5:  Uncontained  Running  Cracks  Caused  the  Breakup  of  this  Hydro  Test  of  the 
Retired  Comet  1  (G-ALYU).  Cracks  Propagating  from  Forward  Escape  Hatch  on  the  Port 
Side.  Note  that  No  Straps  or  Shear  Tied  Frames  were  Used.  No  Crack  Arrestment 
Capability  was  Provided  by  this  Construction.  [A2] 
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APPENDIX  A.2 
USAF  Northrop  F-89 
Accident  Summarized  by 
Charles  F.  Tiffany 


Figure  A6:  Photo  of  F-89  Aircraft 


During  1952,  several  F-89Cs  crashed  due  to  wing  structural  failures.  At  least  six  aircraft  lost 
wings  and  crashed  in  the  spring  and  early  summer  of  1952.  One  crash  took  place  at  the 
International  Aviation  Exposition  at  Detroit.  The  Air  Force  was  forced  to  ground  the  entire  -  fleet 
on  September  22,  1952  until  the  cause  could  be  found.  The  fatigue  capability  of  the  wing  to 
fuselage  fitting  was  questioned  and  as  part  of  this  investigation  a  full-scale  wing  fatigue  test  was 
conducted  at  Wright  Air  Development  Center  (WADC).  The  tests  verified  that  the  wing 
attachment  fittings  had  a  very  short  fatigue  life.  During  high-G  maneuvers,  the  wing  tended  to 
twist  at  the  tip,  exerting  excessive  strain  on  the  wing  attachment  points  and  causing  them  to  fail 
due  to  fatigue.  The  large  wingtip  fuel  tanks  were  found  to  be  a  significant  factor  in  exerting  this 
twisting  moment.  A  total  of  194  F-89A,  B,  and  C  aircraft  were  shipped  back  to  Northrop  where 
they  were  fitted  with  stronger  wings  with  redesigned  forged  steel  attachment  fittings.  At  the 
same  time,  a  small  fin  was  added  to  the  outboard  rear  of  each  wingtip  tank,  which  reduced  the 
aerodynamic  forces  on  the  tank  that  caused  it  to  flex  and  twist  during  maneuvering  [A7-A8]. 
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APPENDIX  A.3 
USAF  Republic  F-84 
Accident  Summarized  by 
Charles  F.  Tiffany 


Figure  A7:  Photo  of  a  Pair  of  F-84  Aircraft  in  Flight 


The  most  difficult  of  the  F-84's  development  and  early  operational  problems  were  catastrophic 
wing  failures.  The  Air  Force  knew  of  this  situation  as  early  as  1948,  when  tests  revealed  that  the 
wing  construction  was  the  main  source  of  difficulty  with  the  airplane.  The  fifth  fatal  broken  wing 
accident  (August  1950)  prompted  the  accident  board  to  write,  that  this  type  aircraft  has  a  history 
of  wing  failures.  Following  the  ninth  fatal  accident  caused  by  a  wing  separating  from  the  aircraft, 
the  Air  Materiel  Command  tested  the  structural  strength  of  the  F-84s  and  concluded  that  wing 
failure  was  caused  by  high  speed  pull-up  in  excess  of  specific  limits  noted  in  the  technical  order. 
Therefore,  it  said  that  no  further  engineering  action  was  needed.  However,  after  the  twelfth  fatal 
accident  attributed  to  wing  failure,  the  86th  Fighter-Bomber  Wing  examined  its  F-84s  and  found 
that  60  to  70  percent  had  various  wing  fatigue  cracks.  From  1952  to  1954  approximately  61 
cases  of  rear  spar  cracking  due  to  fatigue  were  encountered  on  the  F-84E  and  G  series  plus  a 
large  number  of  skin  cracks  on  the  D,  E  and  G  series.  As  a  result  of  this  poor  structural  history 
straight  wing  fatigue  tests  were  performed  and  satisfactory  fixes  were  developed  and  verified  so 
as  to  allow  a  3,000-hour  service  life  for  the  aircraft.  This  was  deemed  sufficient  to  reach  the 
planned  retirement  [A7]. 

With  the  service  history  of  the  straight  wing  F-84s  as  a  background,  Republic  Aircraft  attempted 
to  design  about  5,000  hours  into  the  swept  wing  F-84F  (See  Figure  A8).  A  full-  scale  wing 
fatigue  test  was  conducted  at  Wright  Air  Development  Center  (WADC),  which  seem  to  validate 
a  4,000  hour  service  life. 
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APPENDIX  A.4 
USAF  North  American  F-86 
Accident  Summarized  by 
Charles  F.  Tiffany 


Figure  A9.  Photo  of  F-86  Aircraft  in  Flight 


In  1955  the  main  wing  attach  fitting  was  suspected  as  the  cause  of  several  in-flight  wing  losses. 

A  service  wide  inspection  of  all  F-86A,  B,  C,  D,  E,  and  F  series  was  instituted  to  inspect  for 
cracked  fittings.  Of  all  the  aircraft  inspected  515  were  found  to  have  cracked  fittings.  A  wing 
fatigue  test  conducted  at  WADC  found  that  this  fitting  could  crack  as  early  as  600  hours  of 
service  usage  thus  a  fix  was  developed.  This  reinforcement  extended  the  service  life  of  the 
fittings  to  about  2,500  to  3,000  hours  which  was  deemed  to  be  adequate.  In  addition  a  redesigned 
fitting  was  provided  for  future  production  aircraft  [A7]. 
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APPENDIX  A.5 
USAF  Boeing  B-47 
Accident  Summarized  by 
Charles  F.  Tiffany 


Figure  A10:  Photo  of  B-47  Aircraft  in  Flight 


A  structural  crisis  was  reached  within  the  USAF  Strategic  Air  Command  on  13  March  1958, 
when  two  aircraft  broke  up  in  midair  in  separate  incidents.  Near  Homestead  Air  Force  Base, 
Florida,  a  B-47B  disintegrated  at  15,000  feet,  three  minutes  after  takeoff.  Its  center  wing  section 
failed  due  to  fatigue  cracking  at  buttock  line  45.  The  aircraft  had  a  total  of  2,077  hours  at  the 
time  of  the  accident.  See  Figure  All  for  the  critical  locations  on  the  B-47. 


Figure  All:  Sketch  Illustrating  Critical  Locations  of  the  B-47  Aircraft 
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The  same  day  a  TB-47B  broke  up  at  23,000  feet  over  Tulsa,  Oklahoma,  after  the  left  wing  lower 
surface  failed  at  buttock  line  35  causing  the  wing  to  separate  from  the  aircraft.  This  aircraft  had 
2,419  hours  at  the  time  of  the  accident.  While  these  two  accidents  were  being  investigated,  three 
more  crashes  occurred.  On  March  21a  B-47E  disintegrated  during  a  pull-up  near  Avon  Park, 
Florida.  It  had  only  1,129  hours.  Next,  a  B-47E  disintegrated  at  13,100  feet  just  prior  to  a 
refueling  rendezvous  near  Langford,  New  York  on  April  10.  This  failure  occurred  at  the  aft 
wing-to  body  fitting  at  fuselage  station  515.  The  final  tragedy  in  this  series  of  five  accidents 
occurred  on  April  15  when  another  B-47E  with  1,419  hours  took  off  from  McDill  Air  Force 
Base,  Florida  in  a  storm  and  disintegrated.  While  one  of  these  accidents  was  believed  to  be  the 
result  of  static  overload  during  a  pull-up,  the  other  four  were  clearly  the  result  of  fatigue 
cracking. 

As  a  result  of  these  failures  severe  flight  operating  restrictions  and  an  urgent  fleet  wide 
inspection  and  modification  program  was  implemented.  This  program  was  termed  “project  milk 
bottle”  after  the  shape  of  the  attachment  pin  in  the  fuselage  station  515  wing  to  body  fitting. 
However,  the  program  encompassed  much  more  than  this  single  critical  area.  The  endeavor 
involved  1,622  B-47  aircraft  and  by  January  1959  all  of  the  B-47s  had  been  inspected  and 
reworked  at  least  once.  While  this  $62  million  program  allowed  the  strategic  nuclear  bomber 
force  to  resume  its  normal  operations,  it  was  now  clear  that  full-scale  fatigue  tests  were  required 
to  determine  the  useful  life  of  the  modified  aircraft.  A  decision  was  made  to  cyclic  test  the  B-47 
to  failure  at  three  independent  establishments  -  the  Boeing  plant  in  Wichita,  Kansas;  the  Douglas 
plant  in  Tulsa,  Oklahoma;  and  the  NACA  laboratory  at  Langley,  Virginia.  These  tests  were 
initiated  during  the  summer  of  1958  and  soon  disclosed  additional  areas  in  the  fuselage  requiring 
further  modification.  Of  particular  concern  was  cracking  and  failure  of  the  fuselage  longeron  at 
station  508.  Testing  was  completed  by  the  spring  of  1959  at  which  time  it  was  thought  that  a 
3,000-hour  service  life  had  been  assured  and  perhaps  5,000  hours  could  be  achieved  with  further 
modifications  and  inspections.  By  1966  the  B-47  was  phased  out  of  the  nuclear  bomber  force  and 
replaced  by  B-52s  [A9-A11]. 
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APPENDIX  A.6 
USAF  McDonnell-Douglas  F-4 
Accident  Summarized  by 
Charles  F.  Tiffany 


McDonnel  Douglas  F-4C  “Phantom  11“ 
USAF  Museum  Photo  Archives 


Figure  A12:  Photo  of  F-4C  and  F-4E  Aircraft  [http://www.af.mil/photos] 


The  F-4  has  a  long  fatigue  cracking  and  structural  failure  history  requiring  many  modifications 
and  multiple  full-scale  fatigue  tests  by  both  the  Air  Force  and  the  Navy.  By  1972  the  Air  Force 
had  purchased  about  2,500  of  these  aircraft  and  had  lost  about  800  of  them  many  of  which  were 
non-combat  accidents.  The  Air  Force  experienced  63  non-combat  losses  in  S.E.  Asia  during  the 
Vietnam  War  compared  to  35  air  combat  losses  plus  347  losses  attributed  ground  fire.  The  Navy 
had  purchased  about  900  aircraft  and  had  lost  about  one  half  of  them.  The  USN  and  USMC 
experienced  84  non-combat  losses  in  S.E.  Asia  during  the  Vietnam  War  compared  to  38  air 
combat  losses  and  105  due  to  ground  fire.  While  there  were  a  variety  of  specific  causes  for  the 
many  non-combat  losses  that  occurred  in  S.E.  Asia  as  well  as  in  the  continental  United  States 
and  around  the  world,  structural/mechanical  failures  were  believed  to  be  a  major  contributor  to 
the  losses.  As  a  result  the  Air  Force  formed  a  damage  tolerance  evaluation  team  along  with 
McDonnell-Douglas  in  1973  and  spent  more  than  two  years  developing  inspection  requirements, 
developing  additional  modifications  and  performing  another  fatigue  test  at  WPAFB  [A  12,  A 13]. 

StructuraFmechanical  cracking  and  failure  problems  on  the  F-4  included  wing  fatigue  cracks, 
wing  spar  stress  corrosion  cracks,  horizontal  tail  upper  surface  fatigue  cracks  and  fuselage 
fatigue  cracks.  In  addition,  there  were  fatigue  cracks  in  and  failures  of  forward  engine  mounts; 
cracking  of  fuselage  fuel  tank  liners  (due  to  excessive  fuel  pressure  from  maneuver  loads) 
causing  bladder  tears  and  in-flight  engine  fires;  cracking  and  failure  of  control  surface  actuators 
causing  airplane  crashes;  cracking  of  outer  wings  due  to  high  cycle  (or  buffet)  fatigue  loading 
and  failure  of  outer  wing  panel  attach  lugs. 

The  sketch  shown  in  Figure  A13  depicts  one  of  many  cracking  problems  that  resulted  in  a  non¬ 
combat  loss  of  an  F-4.  This  one  occurred  at  Nellis  AFB  as  a  result  of  a  fatigue  crack  in  the  aft 
locking  lug  at  the  wing  fold.  The  outer  wing  separated  from  the  aircraft,  hit  the  tail  and  the 
aircraft  broke  apart  in  the  air  and  then  crashed.  Prior  to  this  failure,  there  had  been  34  lug  failures 
found  when  the  wings  were  folded  and  the  lug  would  drop  out.  As  a  result,  it  was  standard 
inspection  procedure  to  fold  the  wings  and  look  for  a  lug  failure  before  flight. 
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Although  the  wing  fold  hinge  was  not  designed  to  be  fail-safe,  it  was  being  managed  as  if  it  were 
fail-safe.  It  worked  34  times  before,  but  obviously  did  not  work  when  the  lug  failed  during  the 
fatal  flight.  In  this  case,  a  small  fatigue  crack  was  also  found  in  the  next  lug  forward,  probably 
caused  by  buffet  loading  that  these  outer  wings  frequently  experienced.  Both  the  frequency  and 
magnitude  of  the  buffet  stresses  on  these  lugs  were  not  anticipated  in  the  original  design  nor 
simulated  during  the  full-scale  fatigue  testing  performed  on  the  airplane  [A12,  A13]. 

This  failure  is  an  example  of  multiple  element  damage  (MED)  overcoming  the  limited  fail-safety 
associated  with  the  wing  fold  lugs.  The  possible  contribution  of  deficient  manufacturing  quality 
to  this  failure  was  never  defined. 
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Figure  A13:  Sketch  of  F-4  Aircraft  Illustrating  Location  of  Failure 
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APPENDIX  A.7 
Northwest  Airlines  Martin  202 
Accident  Summarized  by 
Charles  F.  Tiffany 


Figure  A14:  Photo  of  Martin  202  Aircraft 


A  Northwest  Airline’s  Martin  202  with  33  passengers  and  a  crew  of  4  crashed  near  Winona, 
Minnesota  on  August  29,  1948  killing  all  37  aboard.  The  left  wing  separated  from  the  airplane 
when  flying  in  turbulence  caused  by  a  thunderstorm  in  the  area.  The  cause  of  the  accident  was  a 
fatigue  crack  at  a  step  in  thickness  of  the  lower  front  spar  chord,  which  was  made  from  7075-T6 
aluminum  alloy.  The  aircraft  was  a  non  fail-safe  (“safe-life”)  design  which  had  accumulated  only 
1,321  flight  hours  at  the  time  of  the  accident.  Shortly  after  finding  the  cause  of  this  accident  a 
fractured  lower  spar  chord  was  found  in  the  right  wing  of  another  Martin  202  and  cracks  in 
similar  locations  were  found  in  three  other  aircraft.  This  accident  along  with  the  Comet  fuselage 
failures  in  1954  (See  Appendix  A.l)  contributed  to  the  development  of  the  fail-safe  design 
concept  [A14-A16]. 
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APPENDIX  A.8 

Argentine  State  Owned  YPF  AYRO  748 
Accident  Summarized  by 
Charles  F.  Tiffany  and  Thomas  Swift 


Figure  A15:  Photo  of  AYRO  748  Aircraft 


The  Argentine  state  owned  oil  company,  Yacimientos  Petroliferos  Fiscales  (YPF),  was  making  a 
domestic  staff-transfer  flight  in  its  AVRO  (Flawker  Siddeley)  748  aircraft  on  April  14,  1976, 
when  the  right  hand  wing  failed  followed  by  the  right  hand  tailplane.  The  airplane  was  flying  at 
an  altitude  of  4,000  feet  at  the  time  of  the  structural  failure  causing  the  airplane  to  crash  killing 
the  31  passengers  and  3  crewmembers.  The  accident  occurred  22  miles  north  of  the  Cutral  airport 
in  Argentina.  The  airplane  had  accumulated  a  total  of  25,753  hours  at  the  time  of  the  accident. 
The  cause  of  the  failure  was  fatigue  cracking  in  multiple  rivet  holes  in  the  lower  wing  skin 
(between  stringers  3  and  12)  under  external  reinforcing  doublers  at  the  outboard  engine  rib.  See 
Figure  A16.  The  multiple  site  damage,  MSD,  was  due  to  the  local  stress  concentrations  caused 
by  fastener  loads  not  accounted  for  in  the  original  design.  The  fasteners  attaching  the  external 
doublers  to  the  skin  were  loaded  in  the  spanwise  direction  as  a  result  of  strain  compatibility 
between  the  skin  and  doublers. 

The  AVRO  748  was  the  first  aircraft  designed  by  Hawker  Siddeley  Manchester  Division  that 
was  intended  to  be  fail-safe  by  virtue  of  having  the  up  bending  load  distributed  in  the  skin  made 
up  of  planks  containing  multiple  spanwise  stringers  as  compared  to  being  concentrated  in  front 
and  rear  spar  caps  as  used  in  earlier  AVRO  wing  designs  (i.e.,  the  Manchester,  Lincoln,  Tudor, 
Shakletons  1,  2  and  3,  and  the  Argossy).  The  fallacy  was  that  in  order  for  the  structure  to  be  fail¬ 
safe,  the  failure  or  partial  failure  of  the  load  path  must  be  detected  and  repaired  prior  to  the 
failure  of  the  remaining  intact  structure.  With  the  chordwise  row  of  fastener  holes  in  skin  being 
covered  by  the  external  engine  rib  doublers,  the  critical  fastener  holes  in  the  skin  were  not 
visually  inspectable. 

This  design  was  in  violation  of  the  Civil  Aeronautics  Board’s  1956  CAR  4b. 270  fail-safe  rule, 
which  said  that  a  partial  failure  of  a  principal  structural  element  must  be  obvious  (which  means 
that  it  must  be  readily  detectable).  Also,  the  possibility  of  multiple  site  damage  in  adjacent 
planks  was  not  recognized  nor  discovered  by  a  teardown  inspection  of  a  full-scale  fatigue  test 
aircraft. 
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This  accident  and  the  crash  of  Dan  Air’s  Boeing  707  in  1977  highlighted  some  shortcomings  in 
the  CAR  4b. 270  fail-safe  rule  and  precipitated  a  joint  industry  and  government  effort  that  led  to 
amendment  45  revision  and  expansion  of  FAR  25.571  in  1978.  While  this  amendment  included 
the  requirement  for  damage  tolerance  evaluations  and  the  development  of  Supplemental 
Structural  Inspection  Documents  (SSIDs),  it  did  not  address  all  the  issues  needed  to  achieve  fail- 
safety.  Amendment  45  did  not  address:  1)  the  possibility  of  adjacent  structure  damage  and  2) 
recognize  the  need  to  retain  the  required  residual  strength  for  a  period  of  unrepaired  usage;  nor  it 
did  not  mandate  the  requirement  for  full-scale  fatigue  testing  to  disclose  fatigue  “hot  spots”  and 
provide  an  estimate  as  to  when  fail-safety  may  be  lost  due  to  the  onset  of  WFD  [A17,  A18]. 

Efforts  to  address  these  issues  and  strengthen  the  fail-safe  requirement  came  later  and  are 
described  in  detail  in  final  report  of  the  FAA’s  Technical  Oversight  Group  on  Aging  Aircraft 
(TOGAA)  dated  July  30,  2003  and  revised  August  24,  2004  [A5]. 


View  Looking  Down  on  Wing  Lower  Surface 


Figure  A16:  Sketch  of  AVRO  748  Aircraft  Illustrating  Failure  Location 
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APPENDIX  A.9 

Dan  Air  Airlines  Boeing  707-300 
Accident  Summarized  by 
Charles  F.  Tiffany 


On  May  14,  1977,  a  Boeing  707-300  operated  by  Dan-Air  Services  crashed  on  approach  to 
Lusaka  International  Airport,  located  in  Lusaka,  Zambia.  The  accident  was  caused  by  the  fatigue 
failure  of  the  right  horizontal  stabilizer  or  tail-plane.  This  was  followed  by  a  loss  of  control  and 
the  crash  killing  all  6  occupants.  While  the  aircraft  had  been  certified  as  fail-safe  per  the  1956 
CAR  4b. 270  requirements,  the  upper  rear  spar  chord  failure  (which  occurred  about  100  flights 
earlier)  was  not  discovered  prior  to  the  failure  of  the  fail-safe  chord  during  this  final  landing 
approach.  See  a  photograph  and  a  sketch  of  the  design  in  Figure  A18  [A  19]. 

The  Dan- Air  accident  has  been  pointed  to  by  some  in  the  FAA  as  justification  for  dropping  the 
fail-safe  design  option  and  adopting  the  damage  tolerance  or  slow  crack  growth  based  inspection 
approach,  which  was  adopted  by  the  U.S.  Air  Force  several  years  earlier  for  their  predominately 
single  load  path  combat  aircraft.  However,  this  justification  was  based  on  the  false  premise  that 
damage  tolerance  could  replace  the  fail-safe  concept  rather  than  merely  complement  it  by 
providing  slow  crack  growth  based  inspection  requirements  as  was  originally  intended  by  a  1978 
AIA  Committee.  One  cannot  ignore  the  many  cases  (a  few  of  which  are  pointed  out  in  this 
compendium)  where  fail-safety  has  prevented  the  loss  of  the  aircraft  and  the  fact  that  fail-safety 
is  the  only  concept  that  provides  protection  from  large  damage  threats.  An  important  lesson 
learned  from  this  accident  regarding  fail-safe  design  was: 

Subsequent  to  a  load  path  failure  (in  this  case  the  upper  rear  spar  chord),  it  is  essential  that 
the  remaining  intact  structure  be  able  sustain  the  required  flight  loads  for  a  safe  period  of 
unrepaired  usage,  which  is  long  enough  to  ensure  that  the  failure  will  be  detected  and 
repaired  prior  to  the  failure  of  the  remaining  structure. 

This  obviously  was  not  achieved  in  this  accident  in  that  the  actual  period  of  safe  unrepaired 
usage  was  about  100  flights  before  the  accident  flight  whereas  the  normal  maintenance  “C” 
check  inspection  interval  was  being  performed  every  1800  hours  or  about  every  630  flights.  This 
motivated  the  phrase,  “for  a  period  of  unrepaired  usage”  in  the  definition  of  the  term,  “fail-  safe” 
in  the  current  AC  25.571- 1C.  It  also  resulted  in  the  inclusion  of  an  inspection  threshold  policy  in 
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FAR  25.571  that  says,  “Inspection  thresholds  must  be  established  based  on  crack  growth 
analyses  and/or  tests,  assuming  the  structure  contains  an  initial  flaw  of  the  maximum  probable 
size  that  could  exist  as  a  result  of  manufacturing  or  service-induced  damage  where  it  cannot  be 
demonstrated  that  load  path  failure,  partial  failure,  or  crack  arrest  will  be  detected  and  repaired 
during  normal  maintenance,  inspection,  or  operation  of  an  airplane  prior  to  failure  of  the 
remaining  structure.  [A5]” 

While  the  loss  of  tail-plane  and  the  aircraft  after  16,722  flights  pointed  out  a  major  shortcoming 
in  the  old  CAR  4b. 270  fail-safe  requirement  (which  the  FAA  attempted  to  later  correct  in 
Amendment  96  to  FAR  25.571),  it  does  not  explain  the  root  cause  of  the  fatigue  cracking  that 
resulted  in  spar  cap  failure.  The  available  evidence  indicates  that  this  was  due  to  unanticipated 
high  local  stresses  (and  stress  spectrum)  combined  with  marginal  quality  fastener  installations 
and  potential  environmental  effects.  The  failure  originated  from  a  fatigue  crack  in  a  fastener  hole 
in  the  rear  upper  spar  chord.  Fractographic  analysis  (i.e.,  striation  counts)  indicated  that  there 
were  about  7200  flights  of  slow  crack  growth  before  the  crack  reached  critical  size  and  fractured 
the  upper  chord.  The  fatigue  crack  progressed  from  a  small  upper  surface  comer  crack  (0.02  to 
0.03-inch)  in  a  fastener  hole  in  the  flange  of  the  upper  spar  chord  and  progressed  across  the 
chord  before  reaching  its  critical  size  of  a  couple  of  inches. 

The  specific  origin  (about  a  0.02  to  0.03  inch  corner  radius)  appeared  damaged,  probably  due  to 
impact  after  failure;  consequently  its  exact  nature  could  not  be  determined.  However,  there  was 
evidence  of  fretting  and  corrosion.  There  was  also  evidence  that  some  fasteners  had  high  bearing 
stresses  and  initially  had  uneven  loading  amongst  the  fasteners.  The  fatigue  crack  at  the  origin 
fastener  hole  initially  had  a  rapid  rate  of  growth  for  the  first  two  millimeters  (due  to  the  high 
bearing  load)  and  then  rather  normal  growth  due  to  the  bypass  stress  in  the  flange  [A20]. 

Post  accident  flight  tests  revealed  that  deployment  of  the  speed  brakes  during  landing  role 
produced  a  horizontal  load  spectrum,  which  was  significantly  more  severe  than  assumed  during 
the  original  design.  Obviously,  a  good  knowledge  of  both  the  external  loads  (and  load  spectrum) 
and  the  local  internal  loads  are  essential  in  predicting  crack  initiation,  crack  growth  and  fail-safe 
residual  strength,  which  leads  to  this  second  lesson-learned: 

It  is  essential  that  load  surveys  be  performed  to  develop  accurate  loads  and  load  spectra 
(including  both  ground  and  flight  loads)  for  use  in  damage  tolerance  (i.e.,  crack  growth) 
analyses,  fatigue  analyses  and  fail-safe  residual  strength  and  life  analyses.  These  load 
spectra  are  also  very  important  for  the  full-scale  fatigue  test. 
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Figure  A18:  Photo  of  Right  Horizontal  Stabilizer  that  Separated  from  B-707-321C 
Aircraft  and  Details  of  “Fail-Safe”  Structure  Associated  with  the  Accident 
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APPENDIX  A.10 


Aer  Lingus  -  Irish  International  Airlines  Boeing  707-300 
Accident  Summarized  by 
Charles  F.  Tiffany  and 
Jack  F.  McGuire 


Figure  A19:  Photo  of  Boeing  707-300  Aircraft 


This  Aer  Lingus  Boeing  707-300  flying  out  of  London  on  September  24,  1970  experienced  a 
rapid  decompression;  however,  the  fail-safe  design  prevented  a  catastrophic  failure  that  could 
have  resulted  in  the  loss  of  aircraft.  The  failure  demonstrated  the  ability  of  the  airplane  to  sustain 
a  40  inch  fuselage  crack  plus  a  broken  frame,  which  is  a  current  Boeing  design  requirement  (i.e., 
a  two  bay  crack  plus  a  broken  central  frame)  [A21,  A22]. 

The  location  of  the  failure  was  in  the  main  deck  cargo  door  with  frame  failure  and  skin  cracking 
along  the  upper  hinge  line.  Note  that  the  frame  spacing  in  the  cargo  door  is  10  inches  rather  than 
the  normal  20  inch  spacing  throughout  the  rest  of  the  fuselage.  It  is  believed  that  the  frame 
cracking  occurred  first  followed  by  the  skin  cracking  and  the  blowout.  While  the  specific  cause 
of  the  frame  fatigue  failures  and  skin  cracking  was  not  identified,  it  is  expected  that 
unanticipated  high  local  frame  stresses  was  the  primary  factor.  It  is  not  known  whether  or  not 
there  was  any  manufacturing  or  maintenance  damage  present.  The  main  deck  cargo  door 
apparently  was  not  included  in  the  hydro  fatigue  test  that  was  performed  in  the  1950s;  thus,  this 
critical  area  was  not  identified  by  the  test.  A  photograph  of  the  damage  is  shown  in  Figure  A20. 
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Figure  A20:  Photo  of  Section  of  Boeing  707-300  Aircraft  Lost  Due  to  Fatigue  Failure 
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APPENDIX  A.11.6 
USAF  McDonnell-Douglas  F-15C 
Accident  Summarized  by 
Charles  F.  Tiffany  with  input  from 
Charles  Babish  and  Joseph  Gallagher 


Figure  A21:  Photo  of  F-15  Aircraft  in  Flight 


On  November  2,  2007,  an  F-15C  flown  by  the  Missouri  National  Guard  broke  apart  in  mid-air 
and  crashed  during  a  training  exercise.  An  artist  rendition  of  how  the  forward  fuselage  of  this 
aircraft  manufactured  by  McDonnell-Douglas  separated  just  behind  the  cockpit  is  shown  in 
Figure  A22  [A23]. 


Figure  A22:  Artist’s  Rendition  of  F-15C  Forward  Fuselage  Separation 


Both  Boeing  and  the  Air  Force  Research  Laboratory’s  Materials  Integrity  Branch  (AFRL/RXSA) 
conducted  structures  and  materials  investigations  in  support  of  the  Air  Force’s  Accident 
Investigation  Board  (AIB)  [A24].  The  Boeing  failure  analysis  laboratory  found  a  suspected 
fatigue  crack  in  the  upper  right  hand  longeron  near  the  center  fuselage  station  (CFS)  377  splice 
joint  that  they  thought  could  have  caused  the  catastrophic  failure  (i.e.,  the  longeron  is  a  non  fail¬ 
safe  single  load  path  structure).  The  location  of  this  crack  is  shown  in  the  structural  diagram 
shown  in  Figure  A23. 
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Crack  found  in  upper  longeron 
of  mishap  aircraft 
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Figure  3-56.  Main  Structure  -Sheet  1  «f  l> 


Figure  A23:  Location  of  Crack  Site  in  F-15C  Forward  Fuselage  Upper  Longeron 


The  AFRL/RXSA  performed  a  comprehensive  examination  and  metallurgical  evaluation  of  the 
fractured  longeron  [A25].  They  found  that  the  suspect  crack  originated  due  to  fatigue  in  a  thin 
area  of  a  machined  pocket  in  the  longeron  just  forward  of  CFS  377.  The  web  thickness  at  the 
crack  origin  ranged  from  0.039  to  0.073-inches  compared  to  the  blueprint  minimum  thickness  of 
0.09  inches.  This  of  course  would  result  in  significantly  higher  stresses  in  this  local  area  than  the 
blueprint  configuration.  Also,  the  surface  roughness  of  the  machined  surface  was  rougher  than 
the  blueprint  specification.  The  AFRL/RXSA  report  indicated  that  the  cracking  initiated  at 
multiple  sites  in  machining  groves  in  the  thin  undercut  area  of  the  longeron  web  and  grew  in  a 
stable  manner  over  a  significant  period  of  time  to  where  it  was  through  the  entire  width  of  the 
canopy  sill  web  and  progressing  nearly  0.5-inch  down  the  inner  chord,  when  it  reached  its 
critical  size  at  the  applied  stress  level  and  failure  occurred  This  is  illustrated  in  Figure  A24. 

Based  on  the  AIB  report  [A24],  it  appears  that  the  fatigue  cracking  and  failure  are  due  to  high 
stresses  that  were  the  result  of  poor  workmanship  and  quality  control  (i.e.,  inadequate  receiving 
inspection  of  fracture  critical  parts  that  were  improperly  manufactured  and  inspected  by  a 
subcontractor).  This  failure  demonstrates  the  vulnerability  of  single  load  path  (i.e.,  non  fail-safe) 
structures  to  manufacturing  discrepancies  and  emphasizes  the  importance  of  developing  and 
enforcing  rigid  fracture  control  procedures  (including  factory  inspections  to  ensure  conformation 
to  blueprint  and  in-service  damage  tolerance  based  inspections)  on  those  parts  where  fail-safe 
designs  are  not  practical. 
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Cracks  found  in  right  upper  longeron  of  mishap  aircraft: 

•  Cracks  started  in  area  1,  grew  thru  sill  thickness  from  bottom  side  of  sill 

•  Crack  continued  to  area  2  and  reached  critical  size  (bottom  of  area  2) 

•  High  Speed  running  crack  thru  area  3  resulted  in  failure  of  the  longeron 


Figure  A24:  Cracking  Events  Occurring  in  the  F-15C  Forward  Fuselage  Upper  Longeron 

at  FS377 


The  Technical  Advisor  on  Structural  Integrity  at  WPAFB  [A25]  said  that  subsequent  to  the 
release  of  the  AIB  report  a  further  detailed  stress  analysis  of  the  longerons  was  performed.  He 
indicated  that  the  analysis  revealed  a  local  high  stress  area  that  had  not  been  previously  detected 
by  past  analyses  or  tests.  Major  General  Owen  discussed  this  local  high  stressed  area  in  his 
presentation  to  the  2008  ASIP  conference  [A27].  A  local  change  in  the  load  path  resulted  in 
bending  stresses  combined  with  the  normal  tension  load  in  the  longeron.  Also,  it  was  pointed  out 
that  this  local  “hot  spot”  was  not  revealed  by  the  original  fatigue  test.  This  was  due  to  the  fact 
that  the  test  spectrum  was  much  too  mild  compared  to  the  F-15C’s  actual  usage  spectrum  (by  a 
factor  of  10  or  more)  and  the  original  test  aircraft  probably  did  not  have  the  manufacturing 
discrepancy  found  in  the  accident  aircraft. 

Inspection  of  the  other  operational  F-15C  aircraft  as  part  of  the  accident  investigation  revealed 
fatigue  cracks  in  nine  other  aircraft,  three  of  these  other  aircraft  all  ready  had  cracks  were  already 
completely  across  the  sill  and  into  area  2.  Two  of  these  three  aircraft  had  only  minor 
manufacturing  discrepancies  relative  to  meeting  blue  print  configuration  requirements.  The 
cracks  were  found  were  in  the  analytically  predicted  high  stressed  area,  another  high  stressed 
area  associated  with  a  nearby  machine  land.  A  damage  tolerance  analysis  of  the  longeron 
cracking  locations  was  conducted  to  determine  if  the  structural  safety  of  the  F-15  aircraft  could 
be  protected  by  inspections.  The  required  inspection  intervals  for  the  inspection  approach  was 
based  on  the  longeron  blue  print  configuration,  updated  stress  analysis,  the  current  service  loads 
spectrum  and  an  initial  flaw  assumption  that  the  crack  had  a  through-thickness  size  that  extended 
completely  across  the  sill,  i.e.,  the  crack  completely  covered  area  1  in  Figure  A24.  The  repeat 
inspection  intervals  were  sufficient  to  only  conduct  depot  inspections. 


A23 


In  retrospect,  had  this  “hot  spot“  been  identified  and  the  inspection  intervals  detennined  early  on, 
the  accident  aircraft  would  have  been  inspected  at  least  twice  prior  to  the  accident  flight.  In  other 
words,  the  damage  tolerance  approach  (based  on  an  accurate  detailed  stress  analysis  and  updated 
loads  spectrum)  would  have  protected  the  structural  safety  in  spite  of  the  fact  that  there  was  a 
gross  manufacturing  error  (i.e.,  a  deep  undercut  and  surface  roughness).  It  is  apparent  from  these 
findings  that  there  was  not  only  a  breakdown  in  quality  control  procedures  to  ensure  design 
conformance  as  indicated  by  the  AIB  report,  but  also  there  was  a  breakdown  in  the  basic  ASIP 
requirements.  This  includes  the  need  for:  1)  spectrum  updates;  2)  identification  of  critical  areas 
by  analysis  and  test;  3)  the  implementation  of  an  effective  individual  aircraft  tracking  program; 
and,  4)  the  development  and  implementation  of  a  damage  tolerance  based  inspection  program. 
General  Owen  pointed  out  that  the  F-15  System  Program  Manager  (SPM)  thought  that  the  root 
cause  for  the  accident  was  the  direct  result  of  a  complacent  and  under-funded  ASIP  [A27]. 
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APPENDIX  B 

ACCIDENTS  /  INCIDENTS  RESULTING  FROM  MANUFACTURING 

AND  MATERIAL  DEFECTS 

APPENDIX  B.l 
USAF  Northrop  F-5/T-38 
Accident  Summarized  by 
Charles  F.  Tiffany 


Figure  Bl:  Two  T-38  Trainers  in  Flight 


Figure  Bl  illustrates  two  T-38  aircraft;  the  T-38  aircraft  is  the  two  seat  trainer  version  of 
Northrop’s  F-5  fighter.  The  sketch  shown  in  Figure  B2  depicts  the  failure  of  an  F-5  at  Williams 
AFB,  which  originated  at  a  tool  gouge  in  a  radius  of  the  single  piece,  0.42-inch  thick  wing  plank. 
The  critical  crack  length  of  the  fatigue  crack  was  about  0.20-inches.  A  photo  of  the  failure  origin 
is  shown  in  Figure  B3.  As  a  result  of  this  failure  a  damage  tolerance  assessment  was  performed 
and  damage  tolerance  inspection  requirements  established;  however,  these  inspections  were  not 
completely  successful  in  that  additional  catastrophic  wing  failures  occurred  at  Randolph  AFB 
and  in  PACAF  in  the  mid  1970’s.  The  final  solution  to  this  problem  was  a  wing  redesign  to 
substantially  reduce  the  stress  levels,  incorporate  a  tougher  aluminum  alloy  and  cold  working  of 
the  fastener  holes  [Bl,  B2]. 


Bl 


f  5A  NINE  FAILURE 


Figure  B2: 


Figure  B3: 
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Identification  of  Tool  Damage  Location  and  Resulting  Wing  Separation 

Point 


Tool  Damage  Led  to  Early  Fatigue  Cracking  and  Resulting  Failure  of  the 
Monolithic  Wing 
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APPENDIX  B.2 
USAF  Boeing  KC-135 
Incident  Summarized  by 
Charles  F.  Tiffany 


Figure  B4:  Photo  of  KC-135  in  Flight 


The  KC-135,  shown  in  Figure  B4,  is  a  military  derivative  of  Boeing’s  Dash  80  prototype  and  the 
Boeing  707  commercial  Aircraft.  Like  the  Boeing  707,  the  KC-135  was  designed  to  be  fail-safe, 
but  it  did  have  some  significant  structural  differences  from  the  Boeing  707.  One  major  difference 
was  that  to  save  approximately  600  lb.  of  weight,  Boeing  and  the  USAF  selected  7178-T6 
aluminum  rather  than  2024-T3  aluminum  for  the  wing  lower  surfaces  of  the  KC-135.  Although  it 
was  not  known  at  the  time  (early  1950s),  the  7178-T6  A1  wing  had  much  lower  fracture 
toughness,  smaller  critical  crack  sizes  and  was  much  more  sensitive  to  initial  quality  variations 
(i.e.,  manufacturing  defects)  than  the  Boeing  707  2024-T3  A1  wing.  The  consequences  of  this 
decision  were  as  follows  [B3,  B4]: 

1.  Betweenl966  and  1977,  there  were  28  reported  incidents  of  unstable  fatigue  crack 
propagation: 

.  14  failures  of  six  different  panels  in  the  lower  wing  surface 

•  13  crack  arrests  in  other  fastener  holes  short  of  complete  panel  failure 

.  1  rear  spar  cap  plus  aft  panel  failure 

2.  These  failures  initiated  at  poor  quality  fastener  holes  (manufacturing  defects)  and  thus 
occurred  at  very  low  flight  hours  even  though  the  airplane  had  been  successfully  fatigue 
tested  to  43,  200  cyclic  test  hours.  A  complete  yearly  tabulation  of  the  incidents  is  provided 
in  Table  Bl. 
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Table  Bl.  Listing  of  Annual  Cracking  Incidents  on  KC-135  Aircraft 


Year 

No.  of  Incidents 

Flight  Hours 

1966 

1 

2,800 

1967 

3 

2,800-3,500 

1968 

0 

1969 

6 

1,800-  6,400 

1970 

1 

11,000 

1971 

2 

12,200  &  14,400 

1972 

5 

4,700-12,900 

1973 

2 

5,700  &  5,900 

1974 

2 

6,900  &  7,300 

1975 

1 

7,000 

1976 

4 

7,000-17,000 

1977 

1 

7,500 

3.  All  of  these  failures  were  readily  detectable  or  malfunction  evident.  Most  were  discovered 
post  flight  as  result  of  fuel  leakage. 

4.  An  example  of  one  such  panel  failure  that  occurred  in  1972  at  Fairchild  AFB  is  illustrated  in 
Figure  B5.  A  picture  of  the  failure  origin  is  shown  in  Figure  B6.  Note  that  the  fatigue  crack 
was  still  underneath  the  countersink,  when  it  attained  its  critical  size  and  caused  the  panel 
failure. 


Figure  B5:  Illustration  Shows  Location  of  Fatigue  Crack  Resulting  in  a  28-inch  Panel 
Failure  in  Lower  Surface  of  a  KC-135  Wing  (Fairchild  AFB,  February  1971) 
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Figure  B6:  Photo  Illustrates  the  Critical  Size  of  Fatigue  Crack  was  Covered  by  the 
Fastener  Countersink  Making  It  Impossible  to  Detect  by  Visual  Inspection 


5.  It  should  be  emphasized  that  none  of  these  28  incidents  resulted  in  catastrophic  structural 
failure,  which  attests  to  the  importance  of  the  fail-safe  design.  Twenty-eight  potential 
catastrophic  failures  were  avoided,  because  of  fail-safety! 

6.  A  1977  reevaluation  of  the  fail-safe  residual  strength  levels  in  the  presence  of  a  panel  failure 
concluded  that,  with  the  exception  of  one  or  two  specific  areas,  the  residual  strength  of  the 
wings  exceeded  80%  of  limit  load  (i.e.,  the  old  CAR4b.270  requirement)  providing  there  was 
no  widespread  fatigue  cracking  in  the  adjacent  panels. 

7.  Although  by  1977  the  USAF  and  Boeing  were  performing  Damage  Tolerance  Assessments 
of  their  existing  aircraft  inventory,  it  was  clear  that  that  structural  safety  of  the  KC-135  wings 
could  not  be  protected  by  damage  tolerance  based  inspections  and  continued  fail-safety  was 
mandatory. 

•  The  NDI  detectable  crack  sizes  were  nearly  the  same  as  the  predicted  and  observed 
critical  crack  sizes  resulting  in  extremely  short  repeat  inspection  intervals. 

•  Even  if  inspections  were  technically  feasible  it  would  be  economically  unacceptable 
because  of  the  thousands  of  fastener  holes  that  would  require  inspection. 

8.  Concern  about  the  potential  loss  of  fail- safety  in  the  higher  time  aircraft  due  to  the  onset  of 
WFD  led  Boeing  to  perform  tear  down  inspections  of  several  KC-135  lower  wing  surfaces. 

•  A  wing  with  11,  500  hours  was  torn  down  and  each  fastener  hole  in  selected  areas  was 
inspected  using  an  optical  magnifier.  At  least  698  very  small  fatigue  cracks  were  found 
(most  between  .01  and  .02  inches). 

•  From  these  results  a  Blue  Ribbon  Panel  (made  up  of  industry  and  government  structures 
experts)  estimated  that  the  fail-safe  residual  strength  of  some  aircraft  could  be 
unacceptably  degraded  between  8,000  and  9,000  flight  hours  (i.e.,  the  onset  of  WFD). 
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9.  The  Blue  Ribbon  Panel  recommended  that  a  major  wing  modification  program  (i.e.,  ECP 
405)  be  implemented  immediately  whereby  the  lower  surface  would  be  redesigned  using  the 
2024-T3  aluminum  alloy  used  in  the  707  wing  and  any  aircraft  with  more  than  8,500  flight 
hours  would  be  subject  to  flight  restrictions  until  the  mod  kits  were  installed. 

10.  There  have  been  no  additional  panel  failures,  since  ECP  405  was  implemented  and  the  fail 
safety  of  the  wing  structure  has  been  successfully  maintained  for  the  past  two  to  three 
decades. 
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Appendix  B.3 
USAF  Douglas  C-133 
Accident  Summarized  by 
Thomas  Swift 


Figure  B7:  Photo  of  C-133  Transport  Aircraft  in  Flight 


A  US  Air  Force  C-133  transport  aircraft  (No.  59-530),  manufactured  by  Douglas,  suffered  an 
explosive  decompression  failure  at  an  altitude  of  24,000  feet  while  fully  pressurized  to  6.55  PSI 
on  the  morning  of  6  Feb.  1970  and  crashed  near  McCook,  Nebraska.  The  aircraft  had  completed 
12,200  hours  at  the  time  of  the  accident.  A  longitudinal  skin  crack,  originating  in  the  skin  at  the 
first  hole  in  a  skin-to-frame  shear  clip,  had  propagated  into  two  adjacent  skin  bays  to  a  total 
length  of  1 1 .0  inches  when  fast  fracture  occurred.  The  crack  was  not  arrested  at  adjacent  frames 
resulting  in  an  explosive  decompression  failure  of  the  fuselage  (i.e.,  the  structure  was  not  fail¬ 
safe)  [B5-B7], 

The  fasteners  were  countersunk  into  dimpled  skin.  The  crack  that  propagated  to  failure  grew 
from  a  manufacturing  flaw  caused  by  the  dimpling  operation.  A  C-133  was  successfully  full- 
scale  fatigue  tested  to  38,000  simulated  flight  hours.  The  high  time  airplane  at  the  time  of  the 
accident  had  accumulated  16,000  flight  hours.  A  Douglas  Aircraft  team  designed  a  crack 
arresting  system,  so  as  to  achieve  fail-safety  in  the  remaining  C-133  fleet.  A  sketch  of  the  initial 
manufacturing  flaw  and  subsequent  fatigue  crack  is  shown  in  Figure  B8. 
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DOUGLAS  C-133 


7*r 


DIMPLED 

SKIN 


INITIAL  CRACK 


INITIAL  MANUFACTURE 
ROGUE  FLAW  DUE  TO 
DIMPLING  OPERATION 


SKIN  CRACK  ORIGIN 
AT  FIRST  RIVET  HOLE 
IN  FRAME  SHEAR  CLIP 


SKIN  CRACK  FAST  FRACTURED  AT  11  INCH  TOTAL  LENGTH 
AND  WAS  NOT  ARRESTED 

Figure  B8:  Details  of  the  Cracking  that  Led  to  Failure  of  C-133  Transport  Aircraft 
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Appendix  B.4 
Curtis  Wright  X-19  VTOL 
Accident  Summarized  by 
Charles  F.  Tiffany  and  Thomas  Swift 


Figure  B9:  Photo  of  Curtis  Wright  X-19  Aircraft 


The  Curtis  Wright  X-19  VTOL  Experimental  Aircraft,  a  tri-service  research  project,  crashed 
during  a  flight  test  at  the  FAA  Test  Center  in  Atlantic  City  New  Jersey  in  mid  1965.  The  aircraft 
crashed  after  a  propeller  nacelle  magnesium  casting  failure.  The  cause  of  the  crash  was  a 
manufacturing  defect  in  the  magnesium  sand  casting  used  in  the  propeller  nacelle.  This  material 
flaw  was  a  sand  inclusion  at  the  tip  of  one  of  the  stiffening  ribs  in  the  most  highly  loaded 
location  of  the  nacelle  structure.  Some  of  the  details  of  this  flaw  are  illustrated  in  Figure  B 10 
[B5,B7], 


Figure  BIO:  Sketch  of  Flaw  Details  Associated  with  X-19  Aircraft  Accident 
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APPENDIX  B.5 
USAF  General  Dynamics  F-lll 
Accident  Summarized  by 
Charles  F.  Tiffany 


Figure  Bll:  Photo  of  F-lll  Aircraft  in  Flight 


On  December  22,  1969,  the  left  wing  pivot  fitting  of  U.S.  Air  Force  F-lll  No.  94  aircraft  failed 
during  a  4.0g  pull-up  maneuver  from  a  practice  bombing  run  at  Nellis  Air  Force  Base  in  Nevada. 
This  was  a  fighter  airplane  designed  and  manufactured  by  General  Dynamics  for  a  limit  load 
factor  of  7.33.  Aircraft  No.  94  had  only  accumulated  105  flight  hours  at  the  time  of  the  accident. 
The  cause  of  the  failure,  resulting  in  loss  of  the  aircraft  and  crew  of  two,  was  attributed  to  the 
presence  of  a  manufacturing  defect  (a  forging  lap)  in  the  D6AC  steel  pivot  fitting.  A  Photo  of  the 
fracture  face  is  shown  in  Figure  B.12.  The  dark  portion,  shaped  like  the  crescent  on  a  thumbnail, 
was  the  manufacturing  defect  that  existed  when  the  aircraft  was  delivered  to  the  USAF.  The 
narrow  band,  lighter  in  color,  is  the  growth  of  the  manufacturing  flaw  in  105  hours  of  flight.  This 
crack,  the  manufacturing  defect,  in  F-l  1 1  No.  94  is  arguably  the  most  infamous  crack  in  aviation 
history  [B8,  B9]. 

The  USAF  convened  a  special  Scientific  Advisory  Board  (SAB)  to  investigate  the  ramifications 
of  this  accident.  Many  innovations  in  structural  integrity  came  about  because  of  this  failure.  The 
USAF  conducted  a  comprehensive  evaluation  of  their  Aircraft  Structural  Integrity  Program 
(ASIP).  They  abandoned  the  previous  safe  life  approach  to  fatigue  design,  revised  MIL  STD 
1530  [B 10],  released  MIL  A  83444  (Damage  Tolerance  Requirements)  [B 1 1]  and  performed 
Durability  and  Damage  Tolerance  Assessments  (DADTAs)  of  all  of  their  existing  airplane  fleets. 
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Figure  B12:  Photo  Illustrating  Forging  Flaw  and  Subsequent  Fatigue  Crack  that  Caused 
the  Failure  of  F- 111  Aircraft  after  105  Hours  of  Flight  Time 
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APPENDIX  C 

ACCIDENTS  /  INCIDENTS  RESULTING  FROM  MAINTENANCE 

DEFECTS/DEFICIENCIES 

APPENDIX  C.l 
Beech  99  Commuter  Aircraft 
Accident  Summarized  by 
Thomas  Swift 


Figure  Cl:  Photo  of  Beech  Commuter  Aircraft 


A  Beech  99  commuter  aircraft  with  a  single  spar  wing  was  being  maintained.  During  this 
maintenance  a  fastener  was  removed  by  knocking  the  head  off  with  a  hammer  and  chisel  as 
illustrated  in  Figure  C2.  This  action  left  a  sharp  fragment  of  the  head  on  the  shank  of  the 
fastener,  which  gouged  the  side  of  the  fastener  hole  as  the  fastener  was  being  driven  out.  The 
spar  was  re-assembled  without  removing  the  groove  and  the  aircraft  was  returned  to  service. 
During  a  routine  inspection,  2100  flight  hours  later  in  July  1990,  a  fatigue  crack  was  found  that 
had  nucleated  at  the  groove  and  propagated  to  the  edge  of  the  flange  as  shown  in  the  photo  in 
Figure  C3.  A  limit  load  application  would  have  failed  the  wing.  The  spar  had  a  10,000  hour 
fatigue  life  limit  based  on  the  most  critical  fastener  hole  in  the  spar  cap.  The  gouge  in  the  side  of 
the  hole  is  clearly  a  “ maintenance  defect  Cl]. 


Cl 


Most  Critical  Location  Critical  Fastener  Head 

in  the  Airplane  Removed  by  Hammer 


Groove  in  Hole 


Figure  C2:  Details  of  Maintenance  Action  that  Led  to  Damage 


Figure  C3:  Photo  of  Damaged  Hole  and  Cracked  Spar  Cap 
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APPENDIX  C.2 
Eastern  Airlines  Boeing  727 
Accident  Summarized  by 
Charles  F.  Tiffany  with  input  from 
Thomas  Swift  and  Jack  McGuire 


Figure  C4:  Photo  of  Boeing  727  Aircraft 


The  second  example  concerns  an  Eastern  Airlines  727  that  suffered  sudden  cabin  decompression 
caused  by  fatigue  cracking  induced  by  the  X-Acto  knife  maintenance  induced  damage  as  shown 
in  Figure  C5.  The  rivets  in  the  lap  splice  had  been  removed  to  clean  out  corrosion  in  the  splice. 
Cold  cure  adhesive  tape  had  been  replaced  and  the  excess  tape  trimmed  off  with  an  X-ACTO 
knife.  The  knife  created  a  sharp  gouge  in  the  skin  that  became  sites  for  the  nucleation  of  fatigue 
cracks.  Separate  fatigue  cracks  linked  together  to  form  a  long  crack  which  eventually  fast 
fractured  and  caused  decompression.  Fortunately,  the  fast  fracture  was  successfully  arrested  by 
the  aluminum  crack  stoppers  located  at  the  circumferential  frames  as  shown  in  the  sketch.  The 
very  large  damage  ‘crack  arrest  fail-safe’  capability  designed  into  this  fuselage  saved  this  aircraft 
|C2,C3|. 


Hole  Blown  In 
Fuselage  SkinN- 


Circumferential 
Frame 


Aluminum 
Crack 
Stopper 


X-Acto 
Knife 
Scrim 
Cloth 


Skin  Gouge  Created  By  Trimming 
Scrim  Cloth  Resulted  In  Early 
Fatigue  Cracking  Followed  By 
Cabin  Decompression 


Skin  Lap  Splice 


Figure  C5:  Maintenance  Action  that  Fed  to  Skin  Failure  by  Fatigue 
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Photographs  of  the  arrested  damage  are  shown  in  Figure  C6. 


=astem  W.  Virginia  December  26,  1988 


Figure  C6:  Photos  Illustrating  the  Structural  Damage  Resulting  from  Fatigue  Skin  Failure 
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APPENDIX  C.3 

American  Airlines  McDonnell-Douglas  DC-10 
Accident  Summarized  by 
Charles  F.  Tiffany  with  Input  from 
Thomas  Swift 


Figure  C7:  Photo  of  DC-10  Aircraft 


One  of  the  most  dramatic  examples  of  a  major  airplane  accident  caused  by  maintenance  damage 
was  the  crash  of  American  Airlines  DC-10  Flight  No.  191  during  takeoff  from  Chicago  O’FIare 
field  on  May  25,  1979.  This  crash  resulted  in  the  loss  of  273  lives  (271  in  the  aircraft  and  2  on 
the  ground).  During  this  takeoff,  the  No.  1  engine  and  pylon  separated  from  the  aircraft  and  flew 
up  and  over  the  port  wing  and  fell  back  on  the  runway  behind  the  aircraft  (See  Figure  C8).  As  a 
result  of  this  engine  and  pylon  separation  damage  was  inflicted  to  the  wing  leading  edge  slat  and 
the  hydraulics  system.  The  loss  of  hydraulics  fluid  caused  the  outboard  leading  edge  slats  to 
retract.  While  the  system  failures  in  themselves  should  not  have  been  fatal,  the  retraction  of  these 
leading  edge  slats  (which  was  unknown  to  the  flight  crew)  had  a  profound  effect  on  the  aircraft’s 
aerodynamic  performance  and  controllability.  With  the  port  outboard  slats  retracted  and  all 
others  extended,  the  lift  on  the  port  wing  was  reduced  and  the  stalling  speed  increased.  With  little 
or  no  warning  of  the  wing  stall,  the  crew  was  unable  to  compensate  for  the  asymmetric  condition 
and  was  unable  to  prevent  the  crash  [C4-C6]. 

From  the  detailed  investigation  it  became  clear  that  the  pylon  separation  began  when  the  upper 
flange  of  the  rear  bulkhead  in  the  pylon  failed.  There  was  a  pre-existing  10-inch  long  crack  plus 
a  total  of  about  3-inches  of  fatigue  growth  in  this  upper  flange.  A  crescent  shaped  deformation  of 
the  upper  flange  exactly  matched  the  radius  of  the  wing  clevis  fitting.  This  strongly  suggested 
that  the  flange  had  been  cracked  when  the  pylon  and  engine  was  being  removed  or  reinstalled 
during  maintenance.  Further  investigation  revealed  that  both  American  and  Continental  Airlines 
had  devised  an  expedited  procedure  using  a  fork-lift  for  removing  and  reinstalling  the  engine  and 
pylon  as  a  single  unit  rather  than  separately  removing  the  engine  and  then  the  pylon  as 
recommended  by  the  airplane  manufacturer.  This  expedited  procedure  under  certain 
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circumstances  could  result  in  very  large  impact  loads  at  the  rear  bulkhead  attachment  point  and 
inflict  the  type  of  damage  observed.  Inspection  of  other  DC- 10s  where  this  expedited  removal 
procedure  was  used  revealed  eight  other  aircraft  with  cracks  ranging  from  3  to  6-inches  long. 
While  the  manufacturer,  McDonnell-Douglas  Aircraft,  had  designed  the  airplane  including  many 
areas  of  the  pylons  to  be  fail-safe,  it  was  not  fail-safe  for  this  particular  failure  scenario.  The  rear 
bulkhead  itself  was  split  to  achieve  fail-safety,  but  the  upper  flange  on  the  forward  half  of  the 
bulkhead  was  a  single  load  path,  and  when  the  upper  flange  failed,  the  loss  of  the  pylon  and 
engine  ensued. 


Figure  C8:  Diagrams  Illustrating  Nature  and  Result  of  the  Maintenance  Damage  in  the 

Cause  of  a  DC-10  Pylon  Failure 
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APPENDIX  C.4 
Japan  Airlines  Boeing  747SR 
Accident  Summarized  by 
Charles  F.  Tiffany  with  Input  from 
Thomas  Swift  and  Jack  McGuire 


Figure  C9:  Photo  of  Boeing  747SR  Aircraft 


On  August  12,  1985  a  JAL  747  crashed  in  the  mountains  in  the  Guma  prefecture  of  Northern 
Japan  resulting  in  520  fatalities.  This  airplane  had  flown  18,700  flights  at  the  time  of  the 
accident.  The  probable  cause  of  this  accident  was  the  rupture  of  the  rear  pressure  bulkhead  that 
released  a  massive  outflow  of  air  into  the  previously  unpressurized  compartment  aft  of  the 
bulkhead.  This  high  pressure  air  then  overcame  the  outflow  vent  door  capacity  and  overloaded 
the  vertical  stabilizer  so  that  about  one-third  of  it  was  lost.  There  was  additional  collateral 
damage  in  that  the  rudder  actuation  hydraulic  valve,  fed  by  all  four  independent  hydraulic 
systems  for  fail-safety,  was  lost  causing  all  hydraulic  fluid  to  be  lost.  The  aircraft  was  able  to 
continue  flying  for  32  minutes  using  engine  differential  thrust  for  control  [C7,C8]. 

The  rear  pressure  bulkhead  of  this  aircraft  had  been  damaged  due  to  a  tail  strike  in  Osaka  on  June 
16,  1978.  At  that  time  the  aircraft  had  experienced  6516  pressurized  flights.  Boeing  sent  a 
maintenance  team  to  Japan  to  conduct  the  repair.  The  domed  bulkhead  is  made  up  of  pie  shaped 
pieces  of  2024-T3  spliced  together  with  two  rows  of  rivets  as  shown  in  the  sketch  below.  The 
lower  half  of  the  bulkhead  was  replaced  due  to  damage.  During  the  repair  one  row  of  the  rivet 
holes  had  insufficient  edge  distance  so  a  splice  plate  was  installed  over  a  36-inch  length  of  the 
bulkhead  web  as  also  shown  in  Figure  CIO  [C2,  C7,  C8]. 
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Rear  Pressure  Bulkhead  Rupture  Due  to  MSD 
520  Fatalities 


Caused  by  Rogue  Faulty  Repair 

One  Row  of  Rivets  Carrying  Hoop  Tension  Load 
Due  to  Cabin  Pressure  Instead  of  the  Required 
Two  Rows 


w  & 

Crack  Stopper  Straps 


MSD  Over  40  Inches  Of 
Single  Rivet  Splice  In 
Bulkhead  Web 


Bulkhead  Made  Up  From 
Pie  Shaped  Segments 
With  Two  Rivet  Rows 


Segment  of  Rear  Pressure  Bulkhead 


Figure  CIO:  Sketches  of  Location  of  Failure  in  747SR  Rear  Pressure  Bulkhead 


The  splice  plate  was  incorrectly  installed  in  two  pieces  as  shown  in  Figure  Cl  1  such  that  only 
one  row  of  rivets  was  carrying  load.  Because  of  this  overload,  multi-site-damage  initiated  over  a 
40  inch  length  of  the  bulkhead  web  splice  at  the  single  row  of  rivets.  The  multi-site  damage 
linked  up  into  a  critical  crack,  which  did  not  arrest,  because  of  the  MSD,  and  caused  the 
bulkhead  to  fail.  Subsequent  to  this  accident  Boeing  redesigned  the  bulkhead  with  heavier 
“super”  tear  straps. 
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Figure  Cll:  Construction  Details  Associated  with  Initial  and  Repaired  747SR  Rear 

Pressure  Bulkhead 

In  addition  to  the  manufacturing  defect  of  the  two-piece  splice  plate,  the  rivets  in  the  single  row 
were  “clinched”  as  indicated  in  the  photographs  and  sketches  shown  in  Figure  C12.  Clinching  is 
caused  by  misaligning  the  bucking  bar  to  the  rivet.  Consequently  the  head  is  smeared  to  one  side 
leaving  a  gap  in  the  hole  as  shown  in  the  figure.  A  clinched  rivet  does  not  properly  fill  the  hole 
and  will  result  in  a  much  earlier  crack  initiation.  Along  with  the  high  stresses  caused  by  the 
single  rivet  row  these  repair  defects  contributed  to  the  early  development  of  the  multi-site 
damage.  In  fact,  it  is  quite  possible  that  if  these  rivets  had  been  properly  bucked  the  airplane 
would  have  been  retired  before  the  accident  took  place. 
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Figure  02:  Photos  Illustrating  Rivet  Damage  on  747SR  Rear  Pressure  Bulkhead 
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APPENDIX  C.5 
China  Airlines  Boeing  747 
Accident  Summarized  by 
Charles  F.  Tiffany  with  input  from 
Steven  Chisholm 


Figure  C13:  Photo  of  Boeing  747-200 


On  May  25,  2002  China  Airlines  Flight  0611,  A  Boeing  747-200  experienced  an  explosive 
decompression  at  an  altitude  of  34,900  feet.  The  aircraft  was  on  a  scheduled  flight  from  Taipei, 
Taiwan  to  Hong  Kong,  China  when  it  crashed  into  the  Taiwan  Strait  23  miles  northeast  of 
Makung,  Penghu  Islands.  There  were  225  fatalities  (206  passengers  and  19  crew  members).  The 
aircraft  had  accumulated  20,400  flight  cycles  compared  to  the  original  design  goal  of  20,000 
cycles  [C9-C 11], 

The  Republic  of  China’s  Aviation  Safety  Council  concluded  that  the  in  flight  breakup  of  Flight 
0611  was  the  result  of  structural  failure  of  the  lower  aft  lobe  of  the  pressurized  fuselage.  They 
concluded  that  the  structural  failure  was  in  turn  due  to  a  faulty  repair  of  damage  that  occurred  to 
the  lower  lobe  some  22  years  prior  to  the  accident  flight.  On  February  7,  1980  this  aircraft 
(which  was  nearly  new  at  the  time)  suffered  a  tail  strike  while  landing  in  Hong  Kong.  This  tail 
strike  resulted  in  scrapes  to  the  fuselage  both  in  the  pressurized  Section  46  and  the  non- 
pressurized  Section  48  tail  cone.  Temporary  repairs  were  made  the  next  day  and  permanent 
repairs  were  made  on  May  23  through  26,  1980,  No  permanent  records  of  these  repairs  were 
found  and  the  China  Airlines  staff  indicated  that  they  considered  the  repairs  to  be  minor  and  thus 
it  was  not  necessary  to  keep  records  or  report  them  to  Boeing  [Cl 2]. 

Inspection  of  the  recovered  skin  panels  indicated  that  the  repairs  were  not  made  in  accordance 
with  the  Boeing  Structural  Repair  Manual  (SRM).  The  SRM  said  that  the  scrape  marks  (i.e., 
sharp  edged  scratches)  must  be  cleaned  up  and  if  they  exceed  15%  of  the  skin  thickness  in  depth 
the  damaged  area  must  be  removed  and  repaired  with  a  doubler  or  the  skin  panel  replaced.  The 
scratches  did  exceed  the  allowable  depth,  were  not  completely  cleaned  up  by  sanding  and  were 
covered  up  with  a  doubler  that  did  not  extend  sufficiently  beyond  the  damaged  area.  In  fact  the 
longitudinal  scratch  that  initiated  the  fatigue  crack  that  led  to  the  fuselage  failure  was  located 
under  the  doubler,  but  just  beyond  (and  in  some  areas  through)  the  outer  row  of  fasteners,  which 
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attached  the  doubler  to  the  fuselage  skin.  Thus  the  doubler  was  ineffective  in  reducing  the 
applied  hoop  stress  in  the  skin  at  this  longitudinal  scratch. 

During  the  interim  22  years  of  service  subsequent  to  the  repair,  fatigue  cracks  initiated  at  the  root 
of  this  scratch  at  numerous  sites,  grew  through  the  thickness  and  linked  up  forming  a  15.1-inch 
long  through  the  thickness  crack  centered  at  fuselage  station  2100.  Some  multiple  site  cracking 
(MSD)  was  present  both  forward  and  aft  of  this  crack  which  formed  a  total  length  of  about  25.4 
inches.  It  is  evident  from  fretting  marks  and  additional  crack  arrest  and  fatigue  marks  that  the 
actual  crack  length  that  existed  just  prior  to  the  final  failure  was  very  much  longer.  Based  on  the 
fretting  evidence  the  Aviation  Safety  Council  concluded  that  the  crack  length  that  existed  at  the 
time  of  the  accident  had  to  be  at  least  71 -inches.  Based  on  the  indications  of  crack  arrest 
followed  by  increments  of  fatigue  striations,  The  Boeing  Materials  Technology  organization 
(BMT)  estimated  the  final  crack  length  to  be  about  93-inches  long.  See  Figure  C14. 


Figure  C14:  Crack  Location  under  Edge  of  Repair  Doubler  [C9] 


The  repair  doubler  was  made  from  0.063-inch  thick  2024-T3  aluminum  and  was  23-inches  wide 
by  120  inches  long, 

Figure  C 15  is  a  photograph  of  a  portion  of  the  fracture  face  showing  bands  of  fatigue  growth 
following  increments  of  unstable  crack  growth  and  arrest  (i.e.,  termed  quasi  stable  growth  by 
BMT).  Each  of  the  bands  of  fatigue  growth  represents  a  number  pressurization  cycles.  Note  that 
the  crack  location  is  outside  the  outer  row  of  fastener  holes,  but  still  covered  by  the  doubler. 
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Figure  C15:  Quasi-stable  Crack  Growth  Identifying  Numerous  Starter  Cracks  (Prior  to 

Final  Fracture)  [C9]. 


Boeing  developed  a  non-linear  finite  element  model  to  predict  the  effect  of  the  doubler  on  the 
residual  strength  vs.  crack  length,  when  the  skin  was  cracked  in  the  observed  location  and  not 
allowed  to  bulge  because  of  the  doubler.  The  analysis  indicated  that  the  doubler  does  increase  the 
residual  strength  by  a  small  amount  and  the  crack  length  at  failure  was  increased  from  about  50 
inches  to  about  58  inches  when  the  doubler  was  installed.  This  was  attributed  to  the  doubler 
allowing  increased  load  redistribution  around  the  cracking  area  and  a  small  decrease  in  the  crack 
tip  stress  intensity.  This  result  is  shown  in  Figure  C16.  It  is  noted  that  this  prediction  is 
conservative  when  compared  to  the  previously  mentioned  71  inch  and  93  inch  values.  At  any  rate 
the  structure  has  a  very  large  damage  capability  in  excess  of  a  two  bay  crack  length. 
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Figure  C16:  Predicted  Residual  Strength  vs.  Crack  Length  [C9] 
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The  author  of  this  summary  report  has  a  few  observations  that  are  important  when  attempting  to 
prevent  future  accidents  like  shown  in  this  accident.  They  are  as  follows: 

1.  As  evidenced  by  the  metallurgical  evaluation  of  this  accident  and  the  residual  strength 
analyses  performed  by  Boeing,  it  is  clear  that  the  Boeing  747  fuselage  has  a  significant  large 
damage  capability.  This,  of  course,  is  also  supported  by  other  incidences  contained  in  this  report. 
However,  this  China  Airlines  accident  emphatically  illustrates  that  to  be  fail-safe  the  large 
damage  (i.e.,  the  arrested  crack)  must  be  detected  and  timely  corrective  actions  taken  to  preclude 
a  complete  failure. 

2.  It  is  apparent  that  the  doubler  designed  and  installed  by  China  Airlines  not  only  deviated  from 
the  Boeing  SRM  requirements  (by  not  removing  the  damaged  material  and  not  making  the 
doubler  sufficiently  large),  but  it  also  had  a  highly  adverse  effect  on  the  ability  to  readily  detect 
the  fatal  skin  crack. 

a. )  The  doubler  prevented  visual  detection  from  the  exterior  of  the  aircraft  during  walk 

around  ground  inspections  or  during  more  than  20  heavy  maintenance  checks  that  were 
performed  prior  to  the  accident  flight.  While  records  indicate  that  the  interior  of  the  aft 
lower  lobe  was  visually  inspected  during  a  zonal  inspection  in  January  1999,  the  area  was 
not  cleaned  prior  to  the  inspection  and  no  magnifying  glass  was  used.  No  NDI  devices 
were  used  in  any  of  the  inspections  of  this  area. 

b. )  The  doubler  inhibited  skin  bulging  at  the  crack  when  the  fuselage  was  pressurized  thus 

tending  to  significantly  reduce  air  leakage,  which  otherwise  may  have  provided  in-flight 
evidence  of  the  problem. 

3.  It  seems  ironic  that  instead  of  restoring  the  structural  integrity  of  the  fuselage  after  the  1980 
tail  strike  (as  would  have  been  the  case  had  the  SRM  been  followed)  the  China  Airlines  repair 
did  not  significantly  slow  the  initiation  and  growth  of  the  fatal  crack  and  actually  destroyed  fail- 
safety  that  likely  would  have  saved  the  aircraft  had  the  repair  not  even  been  performed. 
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APPENDIX  C.6 

Chalk  Airways  Grumman  Mallard  G-73 
Accident  Summarized  by 
Charles  F.  Tiffany 


Figure  C17:  Photo  of  Grumman  Mallard  (G-73) 


On  December  19,  2005  the  right  wing  separated  on  Chalk  Airway’s  G-73  seaplane  shortly  after 
takeoff  from  Miami,  and  the  crash  into  the  coastal  water  killed  all  20  aboard.  The  wing  was 
recovered  from  the  water  on  Dec.  20  and  National  Transportation  Safety  Board  (NTSB) 
engineers  and  metallurgists  quickly  observed  that  the  wreckage  indicated  fatigue  fracture  of  the 
wing  spar  (see  photo  below).  As  an  immediate  result,  Chalk's  grounded  its  remaining  fleet  of  G- 
73  airplanes.  The  Federal  Aviation  Administration  did  not  order  grounding,  preferring  instead  to 
advise  operators  of  what  happened.  The  December  23  advisory  was  followed  a  week  later  by  an 
emergency  airworthiness  directive  (AD)  ordering  inspection  of  the  affected  structure  and 
reporting  the  results  to  the  FAA  in  order  for  the  agency  to  have  a  better  appreciation  of  the  extent 
of  the  problem.  Frakes  Aviation  (formerly  Grumman  American)  developed  the  nondestructive 
inspection  procedure  that  was  used  [Cl 3,  04]. 

The  investigation  determined  that  the  right  wing  separated  because  of  preexisting  fatigue 
fractures  in  a  double  drilled  fastener  hole  in  the  lower  skin  and  rear  lower  spar  cap.  They  said 
that  this  fatigue  damage  reduced  the  residual  strength  capability  of  the  right  wing  structure, 
leading  to  the  failure.  Examination  of  the  wreckage  disclosed  that  a  major  repair  had  been  made 
to  the  lower  right-wing  spar  at  the  location  where  the  wing  separated  from  the  fuselage. 
Maintenance  records  provided  to  the  Safety  Board,  however,  didn’t  contain  any  entry  for  this 
repair. 

There  had  been  a  history  of  fuel  leaks  near  the  area  where  the  wing  failed,  and  the  investigators 
said  these  leaks  were  indicators  of  structural  damage  inside  of  the  wing.  Had  the  leaks  been 
properly  addressed,  the  extent  of  the  problem  could  have  been  discovered,  the  NTSB  reported. 
However,  that  would  not  necessarily  have  made  the  airplane  safe,  according  to  the  investigators. 
Metallurgical  examination  also  showed  significant  fatigue  cracks  affecting  the  airplane’s  left 
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wing,  including  one  crack  on  the  left-wing  front  spar  lower  cap  that  had  extended  from  an  area  of 
corrosion  damage  and  had  begun  to  progress  fairly  rapidly.  The  Safety  Board  said  that  had  the 
airplane  not  experienced  the  catastrophic  failure  of  the  right  wing,  the  crack  in  the  left  wing 
likely  would  have  led  to  a  catastrophic  failure.  The  Board  said  that  the  company’s  maintenance 
program  was  ineffective  at  identifying  and  correcting  the  long-standing  structural  problems  that 
led  to  the  in-flight  separation  of  the  right  wing.  The  company’s  Director  of  Operations  was 
quoted  in  the  NTSB’s  report  as  defending  the  safety  of  airplanes  in  its  fleet  and  pointing  to  the 
company’s  86-year  unblemished  safety  record  before  the  time  of  the  accident.  However,  the 
NTSB  report  referenced  seven  accidents  or  incidents  involving  Chalk’s  aircraft  before  the  crash 
of  flight  101. 

The  Safety  Board  noted  that  the  FAA  inspector  who  was  responsible  for  overseeing  the 
company’s  maintenance  said  it  met  all  FAA  requirements,  and  he  was  comfortable  with  the 
maintenance  being  performed  on  Chalk’s  airplanes.  He  had  conducted  an  aging- aircraft 
inspection  and  records  review  only  a  few  weeks  before  the  accident.  The  Safety  Board  said  he 
should  have  raised  a  red  flag  about  the  recurring  fuel  leaks  on  the  accident  airplane  [03]. 

The  Safety  Board  reported  there  were  some  other  clues  that  should  have  caused  the  FAA  to  look 
more  closely  at  maintenance  on  Chalk’s  aircraft.  Among  these  were:  1)  paperwork  from  the 
Department  of  Transportation  expressing  concern  about  the  airline’s  financial  condition;  2)  an 
incident  in  November  2004,  when  an  airplane’s  elevator  cable  failed  in  flight  and  the  airline 
submitted  a  Service  Difficulty  Report  to  the  FAA;  and,  3)  a  landing-gear-fatigue  failure  incident 
in  2001.  The  NTSB  concluded  that  the  Chalk’s  Ocean  Airways  maintenance  program  plan  was 
inadequate  to  maintain  the  structural  integrity  of  its  aircraft  fleet. 

The  NTSB  determined  that  the  probable  cause  of  this  accident  was  the  in-flight  failure  and 
separation  of  the  right  wing  during  normal  flight,  which  resulted  from:  1)  the  failure  of  the 
Chalk’s  Ocean  Airways  maintenance  program  to  identify  and  properly  repair  fatigue  cracks  in 
the  right  wing;  and,  2)  the  failure  of  the  FAA  to  detect  and  correct  deficiencies  in  the  company’s 
maintenance  program. 

Figure  C18  provides  a  photograph  of  the  fracture  face  of  the  right  wing  rear  spar  cap.  Note  the 
double  drilled  hole,  which  occurred  as  a  result  of  a  repair  performed  at  a  significant  (but 
undetermined)  time  prior  to  the  accident  flight.  Also,  note  the  fatigue  crack  growth  that  occurred. 
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Figure  C18:  Photo  of  the  Fracture  Face  of  the  Right  Wing  Rear  Spar  Cap  [C13] 
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2003. 
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C12  Chisholm,  Steven  A.,  Comments  Mr  Chisholm  was  Boeing  Commercial  Airplanes 
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investigation,  Comments  dated  June  16  2009  through  June  24,  2009. 
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C14  Various  other  descriptions  of  the  accident  including  the  Flight  Safety  Foundation 
Aviation  Safety  Network  at  www.flightsafety.org  and  from  Wikipedia: 
http://en.wikipedia.org/wiki/Chalk%27s  Ocean  Airways  Flight  101. 
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APPENDIX  D 

ACCIDENTS  /  INCIDENTS  RESULTING  FROM  ENVIRONMENTAL 

DAMAGE 


APPENDIX  D.l 

British-European  Airlines  Vickers  Vanguard  951 
Accident  Summarized  by 
Charles  F.  Tiffany 


Figure  Dl:  Photo  of  Vickers  Vanguard  951  Aircraft 


On  October  2,  1971  a  British-European  Vickers  Vanguard  951  in  route  from  London  to 
Salzburg,  Austria  crashed  in  Belgium  killing  a  total  of  63  passengers  and  crew.  The  investigation 
of  this  accident  revealed  that  the  rear  pressure  bulkhead  had  ruptured  allowing  the  pressurized  air 
to  enter  into  the  horizontal  tail  plane  blowing  off  upper  skin  panels  leading  to  their  breakup.  This 
structural  failure  then  caused  the  airplane  to  pitch  down  and  dive  to  the  ground.  A  close 
examination  of  the  fractured  aluminum  pressure  bulkhead  revealed  an  eighteen-inch  wide  area  of 
corrosion  and  disbonded  doubler  strip  near  the  bottom  centerline  of  the  airplane.  This  corrosion 
combined  with  about  2.5-inches  of  fatigue  tears  then  resulted  in  rapid  propagation  and  complete 
rupture  of  the  bulkhead.  This  fracture  initiated  at  point  A  shown  in  Figure  D2.  Moisture  had 
collected  between  the  frame  and  the  inner  surface  of  the  bulkhead  due  to  condensation.  The 
water  was  unable  to  drain  through  a  drain  hole  in  the  lower  end  of  the  frame  web  (not  shown  in 
Figure  D2),  because  it  had  been  inadvertently  filled  with  sealing  paste.  This  water  then  caused 
the  corrosion,  the  disbonding  of  the  doubler  and  the  fatigue  crack  extension  at  point  A  [Dl,  D2]. 
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Figure  D2:  Sketch  of  Construction  Details  that  Led  to  Corrosion  and  Subsequent 
Catastrophic  Failure  of  the  Vickers  Vanguard  951  Aircraft 
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APPENDIX  D.2 

Far  Eastern  Air  Transport  Boeing  737 
Accident  Summarized  by 
Charles  F.  Tiffany  and  Thomas  Swift 


Figure  D3:  Photo  of  Boeing  737  Aircraft 


On  August  5,  1981  Far  Eastern  Air  Transport’s  (FEAT’s)  Boeing  737  B-2603  lost  cabin  pressure 
during  a  flight  from  Taipei  to  Kaohsiung.  On  August  22,  the  same  aircraft  took  off  from  Taipei 
on  a  flight  to  Makung  and  again  lost  cabin  pressure  and  then  returned  to  Taipei  where  some 
repair  work  was  performed  on  the  pack  valves  of  the  environmental  control  system.  Later  that 
same  day  it  again  took  off  as  flight  number  103  to  Kaohsiung.  Fourteen  minutes  after  take-off 
the  aircraft  suffered  an  explosive  decompression  and  crashed  killing  the  104  passengers  and  6 
crewmembers.  The  airplane  had  accumulated  33,313  pressure  cycles  at  the  time  of  the  accident 
[D3], 

The  investigation  revealed  that  the  probable  cause  of  the  accident  was  extreme  corrosion  in  the 
lower  fuselage.  There  were  a  number  of  locations  where  intergranular  corrosion  pits  had 
penetrated  the  skin.  In  addition,  there  was  exfoliation  corrosion  that  caused  extreme  thinning  of 
the  skin  thickness.  Investigation  of  the  repair  history  indicated  that  there  had  been  six  repair 
patches  installed  just  below  stringer  S-26L  while  final  fracture  occurred  at  stringer  S-27L  in  the 
lower  lobe  of  the  fuselage.  While  the  investigation  was  hampered  due  to  difficulty  finding  the 
corroded  belly  skin,  a  farmer  eventually  came  forward  with  a  section  of  the  skin.  This  piece 
indicated  very  severe  corrosion  over  a  length  of  65 -inches  where  the  thickness  had  corroded 
down  to  0.01  inches  from  the  nominal  design  thickness  of  0.036-inch.  This  would  result  in  a 
hoop  stress  of  about  55  KSI  at  the  normal  operating  pressure.  At  this  stress  level,  the  fatigue  life 
is  negligible  and  the  fail-safety  destroyed,  since  the  corrosion  damage  existed  well  beyond  the 
design  fail-safe  damage  size  (i.e.,  a  two  bay  crack  with  a  broken  central  frame).  According  to  the 
signed  inspection  records  the  aircraft  had  received  an  internal  inspection  of  the  lower  lobe 
structure  on  June  22,  1981  and  an  external  inspection  of  the  fuselage  skin  just  nine  days  before 
the  accident.  Based  on  the  extreme  severity  of  the  corrosion  one  certainly  has  to  question 
whether  or  not  the  inspections  were  really  performed.  A  sketch  showing  the  stringer  locations 
and  the  more  severe  areas  of  corrosion  is  in  Figure  D4. 
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Figure  D4:  Sketches  Illustrating  the  Locations  and  Causes  of  Corrosion  on  B737  Aircraft 


Two  photographs  of  corrosion  found  in  the  lower  lobe  of  this  aircraft  are  shown  in  Figures  D5 
and  D6. 
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Figure  D5:  Photo  of  Skin  Corrosion  in  Lower  Lobe  of  B737  Aircraft 
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Figure  D6:  Photo  Illustrating  Loss  of  Frame  and  Stringer  Due  to  Severe  Corrosion 


While  Taiwan  was  responsible  for  the  accident  investigation,  a  U.S.  team  consisting  of 
representatives  from  the  NTSB,  FAA  and  Boeing  assisted.  Tom  Swift  was  the  representative 
from  the  FAA.  While  this  team  waited  for  portions  of  the  accident  aircraft  to  be  recovered,  they 
had  the  opportunity  to  examine  two  other  B  737  aircraft  that  had  approximately  the  same  number 
of  flight  cycles  (33,  274  and  30,  497).  One  aircraft  was  another  FEAT  737  that  was  in 
maintenance  for  an  engine  change  and  the  second  airplane  was  a  China  Airline’s  737  that  was 
having  some  belly  skin  panels  replaced  because  of  corrosion.  Mr.  Swift  reported  that  the  exterior 
of  the  FEAT  737  appeared  to  be  clean,  but  when  the  interior  floor  was  removed  there  were  five 
adjacent  fuselage  frames  that  were  completely  corroded  through  at  stringer  26  on  the  left  hand 
side  of  the  aircraft.  The  inspection  records  indicated  that  this  area  had  been  inspected  and  the 
corrosion  inhibitor  LPS3  applied  just  nine  months  earlier  thus  again  raising  doubts  about  the 
validity  of  the  records.  These  doubts  were  further  reinforced  by  the  fact  that  it  took  two  days  to 
remove  the  floor  because  of  severe  corrosion  in  the  screws  that  attach  the  floor.  It  is  difficult  to 
believe  that  these  same  screws  had  been  removed  just  nine  months  previously  for  the  inspection. 

The  skin  panels  that  were  removed  from  the  FEAT’s  Boeing  737  were  corroded  so  severely  that 
that  they  were  paper-thin  and  could  be  tom  by  hand.  Mr.  Swift  pointed  out  that,  in  addition  to  the 
severe  thinning,  the  intergranular  corrosion  had  caused  severe  pitting  and  holes  in  the  skin.  He 
said  that  it  was  difficult  to  imagine  how  the  fuselage  ever  maintained  pressure.  Photographs  of 
the  skin  removed  from  the  B  737  aircraft  are  shown  in  Figure  D7. 
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Figure  D7:  Photos  Illustrating  Severe  Corrosion  of  FEAT  B737  Aircraft 
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APPENDIX  E 

ACCIDENTS  /  INCIDENTS  RESULTING  FROM  IMPACT  FROM 

GROUND  EQUIPMENT 

APPENDIX  E.l 

Alaska  Airlines  McDonnell-Douglas  MD-80 
Incident  Summarized  by 
Charles  F.  Tiffany 


Aircraft  are  occasionally  damaged  by  ground  equipment.  In  the  act  of  servicing  aircraft  between 
flights,  a  great  deal  of  ground  equipment  operates  in  close  proximity  to  aircraft  fuselages  and 
wings  and  they  occasionally  get  bumped.  Damage  may  be  in  the  form  of  simple  scratches  in  the 
paint  or  small  dents  in  the  skin.  However,  because  aircraft  structures  (including  the  outer  skin) 
play  such  a  critical  role  in  the  safe  operation  of  a  flight,  all  damage  is  inspected,  measured  and 
possibly  tested  to  ensure  that  any  damage  is  within  safe  tolerances.  A  dent  that  may  look  no 
worse  than  common  "parking  lot  damage"  to  an  automobile  can  be  serious  enough  to  ground  an 
airplane  until  a  repair  can  be  made  [El]. 

The  seriousness  of  this  problem  is  illustrated  by  the  December  28,  2005  depressurization  incident 
on  Alaska  Airlines  flight  536.  During  ground  services  a  baggage  handler  hit  the  side  of  the 
aircraft  with  a  tug  towing  a  train  of  baggage  carts.  This  dented  the  metal  skin  of  the  aircraft.  This 
sharp  dent  was  not  reported  and  the  plane  departed.  Climbing  through  26,000  feet  the  cabin 
pressure  and  resulting  membrane  stresses  in  the  skin  resulted  in  skin  cracking  and  arrest.  The 
cabin  depressurized  and  an  emergency  landing  was  made.  Post  landing  examination  of  the 
fuselage  revealed  a  12-inch  x  6-inch  (30-cm  x  15 -cm)  hole  between  the  middle  and  forward 
cargo  doors  on  the  right  side  of  the  fuselage  (See  Figure  E2).  The  fail-safe  design  of  the  MD-80 
fuselage  prevented  an  explosive  decompression,  which  could  have  caused  the  loss  of  the  aircraft 
and  life  of  those  aboard. 
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Figure  E2:  Photo  of  Skin  Failure  Following  Ground  Handling  Damage 
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APPENDIX  E.2 

Varig  Brazilian  Airlines  Boeing  747 
Incident  Summarized  by 
Charles  F.  Tiffany 


Figure  E3:  Photo  of  Boeing  747  Aircraft 


A  65-inch  crack  was  discovered  in  the  fuselage  of  a  Varig  Brazilian  Airline  747  aircraft  on  May 
22,  1988.  Investigation  of  the  incident  revealed  that  the  side  of  the  fuselage  had  been  impacted 
by  an  air-stair  during  ground  operations  in  Bermuda.  This  impact  precipitated  the  65  inch  long 
skin  crack.  Fail-safety  was  provided  by  the  intact  fuselage  frames  plus  adjacent  skin  [E2]. 
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Figure  E4:  Sketch  Illustrating  Focation  of  Handling  Damage  Induced  Crack  on  the  B'747 
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APPENDIX  GROUP  E  REFERENCES 


El  Incident  reported  in  Seattle  Post  Intelligencer  newspaper  by  James  Wallace,  December 
28,  2005.  Photograph  of  fuselage  depressurization  damage  obtained  from  Internet  at: 
http://www.askthepilot.com/theunthinkable2005.html 

E2  McGuire,  Jack  F.;  “ Fail-Safe  Requirements  for  Aircraft  Structures Presented  at  the 
47th  AIAA/ASME/AHS/ASCE/ASE  Structures,  Structural  Dynamics  and  Materials 
Conference,  Newport,  Rhode  Island,  1-4  May  2006. 
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APPENDIX  F 

ACCIDENTS  /  INCIDENTS  RESULTING  FROM  UNCONTAINED 

ENGINE  FAILURES 

APPENDIX  F.l 

United  Airlines  McDonnell-Douglas  DC-10 
Accident  Summarized  by 
Charles  F.  Tiffany 


Figure  FI.  Photo  of  McDonnell-Douglas  DC-10  Aircraft 


A  United  Airlines  McDonnell  Douglas  DC- 10,  registration  number  N1 81 9U,  on  a  flight  from 
Denver  to  Philadelphia  suffered  a  number  2  tail  engine  failure  on  19th  July,  1989.  The  aircraft 
diverted  to  Sioux  City  Airport  where  it  broke  up  and  burned  while  making  a  crash  landing. 
There  were  185  survivors  and  111  fatalities  [FI,  F2].. 

The  accident  was  precipitated  by  failure  of  the  stage  1  fan  disk  that  had  been  manufactured  by 
General  Electric  Aircraft  Engines.  A  type  1  hard  alpha  particle  in  the  titanium  Ti-61-4V  forging 
in  the  most  highly  stressed  region  of  the  disk  bore  was  not  discovered  by  the  quality  assurance 
program.  Fatigue  propagated  this  manufacturing  defect  to  a  critical  size  when  fast  fracture 
occurred.  The  engine  had  experienced  16,899  cycles  at  failure. 

The  FA  A  formed  a  team  “Titanium  Rotating  Components  Review  Team”  to  investigate  all 
aspects  of  titanium  production.  The  team  visited  23  organizations  and  facilities  as  a  part  of  this 
investigation.  This  investigation  resulted  in  many  changes  to  process  controls  throughout  the 
industry.  The  results  of  the  FAA  investigation  are  contained  in  “Titanium  Components  Review 
Team  Report”  dated  December  14,  1990  [F3].  A  photograph  of  the  airplane  during  its  final 
approach  is  shown  in  Figure  F2.  Figure  F3  shows  the  location  and  size  of  the  initial 
manufacturing  defect  that  resulted  in  the  failure  of  the  stage  1  fan  disk. 
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N1819U  on  its  finaJ  descent.  Note  damage  on  the  horizontal 
Stabilizer  and  fuselage  tailcone. 


Figure  F2:  Photo  of  DC-10  Aircraft  on  Final  Descent  to  Sioux  City 


Sketch  of  Defect  Size  &  Location 
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Figure  F3:  Sketch  of  General  Electric  Engine  Defect  Size  and  Location 
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APPENDIX  F.2 

National  Airlines  McDonnell-Douglas  DC- 10 
Accident  Summarized  by 
Charles  F.  Tiffany 


Figure  F4:  Photo  of  McDonnell-Douglas  DC-10  Aircraft 


This  example  addresses  the  need  to  design  basic  structure  to  tolerate  very  large  damage.  A 
National  Airlines  DC- 10  aircraft,  cruising  over  New  Mexico  on  November  3,  1973  suffered  a 
disintegration  of  the  No.  3  engine.  Engine  fragments  so  severely  damaged  the  fuselage  that  a 
passenger  was  ejected  through  a  window.  The  wing,  empennage  and  the  No.  1  engine  were  also 
severely  damaged  as  depicted  in  the  sketch  shown  in  Figure  F5.  The  extensive  damage  to  the 
fuselage  did  not  precipitate  an  explosive  decompression  failure  because  the  DC- 10  was  designed 
to  sustain  a  two-bay  crack  and  a  broken  central  frame.  This  very  large  damage  tolerance  was 
achieved  through  the  addition  of  a  titanium  crack  arresting  and  crack  stopper  system  [FI,  F4, 

F5] . 

The  National  Transportation  Safety  Board  determined  that  the  probable  cause  of  this  accident 
was  the  disintegration  of  the  No.  3  engine  fan  assembly  as  a  result  of  an  interaction  between  the 
fan  blade  tips  and  the  fan  case.  The  fan-tip  rub  condition  was  caused  by  the  acceleration  of  the 
engine  to  an  abnormally  high  fan  speed  which  initiated  a  multiwave,  vibratory  resonance  within 
the  fan  section  of  the  engine.  The  precise  reason  or  reasons  for  the  acceleration  and  the  onset  of 
the  destructive  vibration  could  not  be  determined  conclusively. 
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Figure  F5:  Sketch  Illustrating  Location  of  Fuselage  Damage  Due  to  an  Uncontained 

Engine  Failure  and  Construction  Details 
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APPENDIX  F.3 
Air  France  Airlines  Boeing  747 
Incident  Summarized  by 
Charles  F.  Tiffany 


Figure  F6:  Photo  of  Air  France  Boeing  747  Aircraft 


In  May  1971,  an  Air  France  Boeing  747  flying  out  of  Paris  had  a  compressor  disk  failure.  The 
resulting  debris  penetrated  the  wing.  The  photographs  in  Figure  F7  show  the  wing  damage  [F6]. 
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Figure  F7:  Photos  of  Wing  Damage  on  the  B747  Aircraft  Caused  By  Engine  Failure 
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APPENDIX  F.4 
UTA  Boeing  747 
Incident  Summarized  by 
Charles  F.  Tiffany 


Figure  F8:  Photo  of  UTA  Boeing  747  Aircraft 


In  January  of  1985  a  747  from  the  French  airline  Union  des  Transports  Ae'riens  (UTA)  had  an 
uncontained  engine  failure  while  over  Zaire.  The  wing  damage  is  shown  in  Figure  F9  [F6]. 


Figure  F9:  Photos  of  Wing  Damage  Caused  by  Engine  Failure 
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APPENDIX  F.5 

Delta  Airlines  McDonnell-Douglas  MD-88 
Accident  Summarized  by 
Charles  F.  Tiffany 


Figure  F10:  Photo  of  McDonnell-Douglas  MD-88  Aircraft 


On  July  6,  1996,  at  1424  central  daylight  time,  a  McDonnell  Douglas  MD-88,  N927DA, 
operated  by  Delta  Air  Lines  Inc.,  as  flight  1288,  experienced  an  engine  failure  during  the  initial 
part  of  its  takeoff  roll  on  runway  17  at  Pensacola  Regional  Airport  (PNS)  in  Pensacola,  Florida. 
Uncontained  engine  debris  from  the  front  compressor  front  hub  (fan  hub)  of  the  No.  1  (left) 
engine  penetrated  the  left  aft  fuselage  (See  Figure  Fll).  Two  passengers  were  killed,  and  two 
others  were  seriously  injured.  The  takeoff  was  rejected,  and  the  airplane  was  stopped  on  the 
runway.  The  airplane,  operated  by  Delta  as  a  scheduled  domestic  passenger  flight  under  the 
provisions  of  Title  14  Code  of  Federal  Regulations  (CFR)  Part  121,  with  137  passengers  and  5 
crew  on  board,  was  destined  for  Hartsfield  Atlanta  International  Airport  in  Atlanta,  Georgia  [F7]. 

The  National  Transportation  Safety  Board  determined  that  the  probable  cause  of  this  accident 
was  the  fracture  of  the  left  engine’s  front  compressor  fan  hub  (i.e.,  disk)  as  shown  in  Figure  F12, 
which  resulted  from  the  failure  of  Delta  Air  Lines’  fluorescent  penetrant  inspection  process  to 
detect  a  detectable  fatigue  crack  initiating  from  an  area  of  altered  microstructure  (i.e.,  a 
manufacturing  defect)  that  was  created  during  the  drilling  process  by  Volvo  for  Pratt  &  Whitney 
and  that  the  defect  went  undetected  at  the  time  of  manufacture. 
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Figure  Fll.  Photo  of  Engine  and  Fuselage  Damage  as  a  Result  of  Engine  Failure 


Figure  F12.  Photo  of  Fractured  Pratt  &  Whitney  Compressor  Fan  Disk 
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APPENDIX  F.6 

Mesa  Airlines  Bombardier  Regional  Jet  CRJ  200 
Incident  Summarized  by 
Charles  F.  Tiffany 


Figure  F13:  Photo  of  Bombardier  Regional  Jet  CRJ  200  Aircraft 


On  January  25,  2007  a  CRJ-200  aircraft  operated  by  Mesa  Airlines  experienced  an  uncontained 
engine  failure  during  a  flight  between  Denver  and  Phoenix.  The  No.  1  engine,  a  GE  CF34-3B1, 
threw  a  fan  disk  and  blades  during  cruise.  The  debris  took  out  the  engine's  forward  cowling  and 
punctured  the  fuselage  as  it  departed  the  aircraft  as  shown  in  Figure  F14  [F8]. 

While  the  No.  1  engine  experienced  a  fan  disk  separation,  it  resulted  in  the  separation  of  the 
inlet,  fan  rotor  assembly,  the  fan  containment  case,  and  portions  of  the  thrust  reverser.  The 
airplane  reversed  course  and  landed  without  further  incident.  Post  incident  examination  revealed 
damage  to  the  aft  portion  of  the  fuselage  and  empennage.  An  examination  of  the  remaining 
airplane  systems  revealed  no  anomalies.  Portions  of  the  fan  disk  were  recovered  and  examination 
of  the  fan  disk  revealed  fatigue  striations  emanating  from  the  aft  bore  comer  of  the  fan  disk.  The 
striations  came  from  an  area  that  exhibited  characteristics  consistent  with  arc-out  damage,  which 
was  the  result  of  improper  assembly  and  marking  procedures  during  the  electrochemical  etching 
process.  This  damage  was  not  detected  during  the  manufacturer's  quality  assurance  process  used 
by  the  manufacturer.  Further,  the  operator  did  not  detect  this  damage  while  conducting  the 
inspections  prescribed  through  required  airworthiness  directives  because  the  inspection 
procedures  required  were  not  detailed  enough  to  detect  the  arc-out  damage  and  the  maintenance 
personnel  did  not  receive  appropriate  training.  Following  the  incident,  the  manufacturer  issued 
alert  service  bulletins  and  the  FA  A  issued  an  airworthiness  directive  to  resolve  these  issues. 
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Figure  F14:  Photo  of  Damage  Associated  With  Engine  Failure 
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APPENDIX  F.7 
American  Airlines  Boeing  767 
Accident  Summarized  by 
Charles  F.  Tiffany 


On  Friday  June  2,  2006,  a  disk  in  the  GE  CF6  No.  1  engine  failed  during  a  ground  run  on  an 
American  Airlines  767.  The  photograph  in  Figure  FI 5  shows  the  failed  engine.  The  photograph 
in  Figure  F16  shows  where  the  disk  fragment  passed  through  the  fuselage  cutting  the  lower 
surface  of  the  center  wing  box.  The  photograph  in  Figure  FI 7  shows  where  the  disk  then 
penetrated  the  casing  of  the  number  two  engine  on  the  opposite  side  of  the  airplane.  The  rear 
fuselage  (See  Figure  FI  8)  and  inboard  flaps  on  the  port  side  experienced  over  heating  from 
escaping  combustor  gases.  It  is  likely  that  the  airplane  could  not  have  survived  had  the  failure 
occurred  during  flight  and  the  failed  disk  followed  the  same  trajectory  and  stopped  the  second 
engine  [F9,  F10,  FI  1] . 


Figure  F15:  Photo  of  Damage  Associated  with  Uncontained  Rotor  Failure  in  a  GE  CF6 

Engine 
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Figure  F16:  Photo  of  B747  Fuselage  with  Disk  Penetration  Damage  Caused  by 

Uncontained  Rotor  Failure 


Figure  F17:  Photo  of  B747  with  Disk  Embedded  in  No.  2  Engine  Resulting  from 
Uncontained  Rotor  Failure  in  No.  1  Engine 
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Figure  F18:  Photo  of  Engine  Damage  to  the  B747  Fuselage  Resulting  From  Engine  Failure 
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APPENDIX  G 

ACCIDENTS/INCIDENTS  RESULTING  FROM  BIRD  STRIKES 

APPENDIX  G.l 

Delta  Airlines  McDonnell-Douglas  MD-88 
Accident  Summarized  by 
Charles  F.  Tiffany 


Figure  Gl:  Photo  of  McDonnell-Douglas  MD-88  Aircraft 


On  February  18,  2008,  a  Delta  Airlines  MD-88  aircraft  was  damaged  when  it  struck  a  large  bird 
while  on  approach  to  Austin-Bergstrom  International  Airport  (Austin,  Texas).  The  aircraft  was 
in  the  descent  phase  of  a  scheduled  flight  to  Austin  from  Atlanta.  The  aircraft  landed 
successfully  and  there  were  no  injuries.  The  damage  to  the  aircraft’s  nose  is  shown  in  Figure  G2 
[Gl]. 


Figure  G2:  Photo  of  Bird  Strike  Damage  to  Radome 
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APPENDIX  G.2 

American  Airlines  Boeing  767-300 
Incident  Summarized  by 
Charles  F.  Tiffany 

On  April  2,  2001  an  American  Airline’s  767-300  enroute  from  Paris  to  Miami  encountered  a 
flock  of  large  birds  while  climbing  through  12,000  feet.  The  radome,  fuselage  and  wing  leading 
edge  all  received  extensive  damage  as  shown  in  the  photographs  below.  One  of  the  large  birds, 
believed  to  be  cormorants,  penetrated  the  cockpit  area  through  the  radome  and  forward  pressure 
bulkhead.  The  aircraft  depressurized  and  the  crew  landed  the  plane  in  Paris  with  no  injuries  [G2] 


Figure  G3:  Photo  of  Bird  Strike  Damage  to  B767  Aircraft  Just  Below  the  Cockpit 

Windows 


4 


% 


Figure  G4:  Photo  of  Bird  Strike  Damage  to  Underside  of  Fuselage  of  B767  Aircraft 
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Figure  G5.  Photo  of  Bird-Strike  Damage  to  Underside  of  B767  Fuselage  Just  Aft  of  the 

Radome 
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APPENDIX  G.3 
USAF  Lockheed  C-130 
Accident  Summarized  by 
Charles  F.  Tiffany 


Figure  G6:  Photo  of  C-130  Aircraft 


In  August  of  2005  an  Air  National  Guard  C-130  transport  aircraft  flying  near  Tacoma, 
Washington  was  hit  by  a  bald  eagle.  As  can  seen  by  the  photos  in  Figures  G7  through  G9,  the 
bird  (obviously  in  excess  of  the  4  pound  design  weight)  penetrated  a  small  window  on  the  left 
side  of  the  cockpit,  missed  the  pilot  and  splattered  against  the  bulkhead  behind  the  pilot  [G3] . 


Figure  G7.:  Photo  of  Bird  Strike  Damage  to  Outside  of  the  C-130  Aircraft 
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Figure  G8:  Photo  of  Bird  Strike  Damage  to  Front  of  C-130  Cockpit 


Figure  G9:  Photo  of  Bird  Strike  Damage  to  Interior  of  the  C-130  Aircraft 
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APPENDIX  GROUP  G  REFERENCES 


G1  Photos  and  description  of  the  incident  available  at  http://aircrewbuzz.com/2008/Q3/bird- 
strike-damages-radome 

G2  Photos  and  description  provided  by  The  Boeing  Company’s  Customer  Service 
Organization. 

G3  Photos  and  description  of  incident  available  at  http://www.militaryphotos.net 
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APPENDIX  H 

ACCIDENTS  /  INCIDENTS  RESULTING  FROM  RUNWAY  DEBRIS 


APPENDIX  H.l 
Air  France  Concord 
Accident  Summarized  by 
Joseph  P.  Gallagher 


Figure  HI:  Photo  of  Concorde 


On  July  25,  2000,  1 13  individuals  lost  their  lives  as  a  result  of  an  Air  France  Concorde 
accident  caused  by  runway  debris.  All  100  passengers  and  nine  crew  members  on  board 
perished,  and  on  the  ground,  four  additional  individuals  died  as  a  result  of  the  crash  [HI,  H2]. 

The  accident  was  found  to  be  caused  as  a  result  of  a  relatively  small  titanium  strap  that  dropped 
to  the  runway  from  a  Continental  Airlines  DC- 10  that  took  off  approximately  5  minutes  before 
the  Concorde  entered  the  runway.  This  titanium  strap  was  about  1.2-inch  wide  and  17-inch  long. 
When  this  titanium  strap  struck  the  tire  on  the  Concorde  wheel  No.  2  (attached  to  the  left  main 
landing  gear)  while  the  plane  was  traveling  at  a  speed  exceeding  190  mph,  it  caused  the  tire  to 
disintegrate.  Pieces  of  the  tire  then  impacted,  with  at  least  one  piece  penetrating,  the  left  wing 
fuel  tank  No.  5  (above  the  left  main  landing  gear). 

The  tire  impact  and  fuel  tank  penetration  was  thought  to  then  cause  a  hydraulic  hammer  shock 
which  resulted  in  further  catastrophic  damage  to  the  fuel  tank  and  a  fire.  Tire  debris  and  the  fire 
caused  the  left  engines  (Nos.  1  &  2)  to  temporarily  shut  down,  and  while  the  pilots  were  able  to 
restart  the  No.  1  engine,  it  recovered  for  only  a  short  period  of  time  but  later  failed  completely. 
The  damage  to  the  landing  gear  prevented  it  from  being  retracted  making  flying  difficult. 
However,  it  was  decided  that  the  major  structural  damage  to  the  left  wing  fuel  tank  and  the  loss 
of  thrust  on  the  Nos.  1  and  2  made  the  aircraft  incapable  of  continuing  flight;  and  shortly  after 
leaving  the  Charles  de  Gaulle  airport,  the  Concorde  crashed. 


HI 


A  large  part  of  fuel  tank  No.  5  was  found  on  the  runway;  the  other  part  of  this  fuel  tank  was 
found  at  the  accident  site  and  had  a  star  shaped  penetration  that  measured  approximately  0.4-inch 
by  1.6-inch.  This  penetration  was  believed  caused  by  a  piece  of  tire. 

A  piece  of  tire  weighing  about  10  pounds  was  found  on  the  runway  close  to  the  titanium  strip 
along  with  other  pieces  of  the  tire.  The  titanium  strip  that  fell  to  the  runway  from  the  DC- 10  was 
part  of  the  thrust  reverser  cowl  door  for  the  No.  3  engine.  The  BEA  investigation  determined 
that  this  strip  was  not  manufactured  nor  installed  in  accordance  to  OEM  procedures;  this  strip 
was  recently  replaced  on  9  July,  16  days  before  it  fell  from  the  DC- 10  during  takeoff. 
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APPENDIX  GROUP  H  REFERENCES 


HI  BEA,  “Accident  on  25  July  2000  at  La  Patte  d’Oie  in  Gonesse  (95)  to  the  Concorde 
registered  F-BTSC  operated  by  Air  France,”  Report  (English)  translation,  Report  no.  f- 
sc000725a,  BUREAUDENCLE  TES  ET  D’ANALYSES  POUR  SECURETE  DE 
L’AVIATION  ,  Ministere  De  L’Equipment  Des  Transports  et  Du  Logement,  CVLE, 
France,  December  14,  2004. 

http://www.bea-fr.org/docspa/2000/f-sc000725a/htm/f-sc000725a.html. 

H2  Concorde  Flight  4590  crash,  retrieved  from  "http://en.wikipedia.org/wiki/Concorde. " 

Wikipedia®  is  a  registered  trademark  of  the  Wikimedia  Foundation.  Inc.,  a  non-profit 
organization. 
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APPENDIX  I 

ACCIDENTS  /  INCIDENTS  RESULTING  FROM  EXPLOSIVE 

PENETRATION 


APPENDIX  1.1 
Qantas  Airlines  Boeing  747 
Accident  Summarized  by 
Charles  F.  Tiffany 


Figure  II:  Photo  of  a  Quantas  Airlines  Boeing  747  Aircraft 


On  July  25,  2008  a  Qantas  Airline  Boeing  747  enroute  to  Melbourne,  Australia  from  London 
was  cruising  at  29,000  feet  when  it  experienced  an  explosive  decompression  of  the  fuselage.  Per 
standard  procedure  the  plane  immediately  descended  to  10,000  feet  and  minutes  later  made  an 
emergency  landing  at  the  Manila  airport  in  the  Philippines.  There  were  346  passengers  onboard 
and  there  were  no  fatalities  or  injuries  to  any  of  the  passengers  or  crew.  Upon  post  flight 
examination  a  large  hole  was  seen  in  the  lower  right  side  of  the  fuselage  just  forward  of  the 
wing.  This  is  shown  in  the  photographs  in  Figures  12  through  14  [II]. 


II 
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Figure  12:  Photo  of  Boeing  747  Fuselage  after  On-Board  Explosion 


Figure  13:  Close  Up  View  of  Boeing  747  Fuselage  after  On-Board  Explosion 
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Figure  14:  Alternate  Close  Up  View  of  Boeing  747  Fuselage  After  On-Board  Explosion 

Illustrating  Loss  of  Structure 


On  August  29,  2008,  the  Australian  Transportation  Safety  Bureau  (ASTB)  confirmed  that  the 
incident  was  caused  by  the  bursting  of  one  of  two  oxygen  bottles  that  were  located  in  this  area  of 
the  cargo  compartment  and  has  been  found  to  be  missing.  Also,  shards  from  the  missing  oxygen 
bottle  and  the  oxygen  regulator  valve  were  found  in  the  fuselage.  This  investigation  the  failure 
provides  another  strong  testament  to  the  importance  of  having  fail-safe  structures  with  large 
design  damage  sizes. 
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APPENDIX  GROUP  I  REFERENCES 

II  Based  on  several  news  reports.  Photos  obtained  from  http://www.airlineempires.net 
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APPENDIX  J 

ACCIDENTS  /  INCIDENTS  RESULTING  FROM  WFD 


APPENDIX  J.l 
Aloha  Airlines  Boeing  737-200 
Accident  Summarized  by 
Charles  F.  Tiffany 


Figure  Jl:  Photo  of  Aloha  Airlines  Boeing  737  Aircraft 


At  1:25  PM  on  April  28,  1988  Aloha  Airlines  Flight  No.  243  departed  Hilo,  Hawaii  with  a  crew 
and  89  passengers  on  board.  When  leveling  off  at  24,000  feet,  there  was  an  explosive 
decompression  of  the  fuselage,  whereby  the  upper  portion  of  the  forward  fuselage  separated  from 
the  airplane.  One  flight  attendant  was  swept  out  of  the  airplane,  but  the  passengers  who  still  had 
their  seat  belts  fastened  remained  on  board,  and  the  pilot  was  able  to  successfully  land  the 
airplane.  Several  of  the  passengers  and  crew  sustained  injuries.  A  photograph  of  the  airplane  is 
shown  Figure  J2  [Jl,  J2]. 


Figure  J2.  Photo  Illustrating  Extent  of  Aircraft  Damage  to  Boeing  737  Aircraft  Following 

Failure  Due  to  Widespread  Fatigue  Damage 
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The  extent  of  the  damage  is  shown  in  the  Figures  J3  and.J4. 
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Figure  J3:  Sketch  Illustrating  Side  View  of  Fuselage  with  Missing  Area  of  Boeing  737 

Aircraft 


Looking  Forward 


Figure  J4:  Sketch  Illustrating  the  Fuselage  Missing  Area  from  a  View  Looking  Forward 
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This  accident  was  a  watershed  event  in  that  it  highlighted  the  fact  that  a  fail-safe  design  will  not 
ensure  structural  safety  after  the  structure  encounters  the  onset  of  widespread  fatigue  damage 
(WFD).  This  normally  occurs  late  in  the  aircraft’s  operational  life,  but  this  onset  can  be 
accelerated  by  other  factors  as  it  was  in  this  case.  At  the  time  of  the  accident  the  airplane  had 
89,680  flight  cycles  compared  to  the  design  service  objective  of  75,000  flight  cycles  thus  it  was 
considered  to  be  an  aging  aircraft. 

The  investigation  of  the  failure  revealed  that  it  initiated  in  the  upper  row  of  rivets  in  the  stringer 
no.  10  (S-10)  longitudinal  lap  splice  that  was  a  cold  bonded  and  riveted  joint.  Boeing  used  this 
cold  bonded  design  in  the  first  291  737  aircraft.  However,  it  was  later  discovered  that  cold 
bonded  joints  can  be  subject  to  disbonding  when  moisture  is  present.  When  this  occurs  all  of  the 
pressure  induced  hoop  load  is  transferred  through  the  rivets  rather  than  the  bonded  surface.  This 
induces  very  high  stress  concentrations  at  the  knife  edge  countersinks  in  the  outer  skin  and 
fatigue  cracks  initiate.  This  is  illustrated  in  the  sketches  shown  in  Figures  J5.  and  J6. 


Figure  J5:  Sketch  Illustrating  the  Development  of  Small  Fatigue  Cracks  in  the  Skin 
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Figure  J6:  Sketch  Illustrating  the  Location  of  Small  Fatigue  Cracks  in  the  Skin 
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At  the  onset  of  WFD  fatigue  cracks  have  initiated  in  adjacent  fastener  holes  and  have  reached  the 
size  and  density  that  the  large  damage  fail-safety  no  longer  exists.  If  allowed  to  continue  to  grow 
the  cracks  will  link  up  thus  forming  a  lead  crack,  which  will  result  in  unstable  rapid  propagation 
when  it  reaches  its  critical  size.  However,  because  of  the  initiation  of  small  cracks  in  the  fastener 
holes  ahead  of  the  lead  crack  it  will  not  arrest  at  the  frames  and  tear  straps  and  complete 
catastrophic  failure  will  ensue.  The  onset  of  WFD  and  the  formation  of  a  lead  crack  is  illustrated 
in  the  sketch  Figure  J7. 


Figure  J7:  Sketches  Illustrating  the  Development  of  Small  Fatigue  Cracks  in  the  Skin 
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This  was  the  progression  of  the  crack  growth  at  the  S-10  longitudinal  lap  splice  in  the  Aloha  737 
fuselage;  unfortunately,  the  lead  crack  was  not  discovered  (and  repaired)  prior  to  the  accident 
flight,  since  the  recommended  inspections  were  never  performed. 

On  Boeing  737  aircraft  beyond  the  291st  aircraft  manufactured,  the  lap  splice  joint  design  was 
improved  with  the  incorporation  of  a  moisture  resistant  hot  bonded  doubler,  which  was  expected 
to  substantially  delay  the  onset  of  WFD.  This  improvement  is  compared  to  the  original  design  in 
Figure  J8. 


Line  No.  1-291  Line  No.  292 -and  After 


Figure  J8:  Sketches  Illustrating  the  Lap  Splice  Joint  Designs  of  the  B737  Aircraft 


Subsequent  to  this  accident  and  failure  investigation  the  FAA  took  a  number  of  actions  directed 
towards  the  prevention  of  further  Aloha  type  accidents  plus  the  broader  issue  of  dealing  with 
aging  aircraft.  They  also  formed  an  independent  Technical  Oversight  Group  on  Aging  Aircraft 
(TOGAA),  which  stayed  in  existence  for  nearly  a  decade  and  one  half.  This  group  guided 
revisions  to  rules  and  advisory  circulars  that  relate  to  fatigue,  damage  tolerance  and  widespread 
fatigue  cracking. 
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APPENDIX  J.2 
US  Forest  Service  C-130A 
Accident  Summarized  by 
Joseph  P.  Gallagher 


Figure  J9:  Photo  of  US  Forest  Service/Hawkins  &  Power  Aviation  C-130A  [J3] 


About  mid-afternoon  on  June  17,  2002,  a  Lockheed  C-130A  owned  by  Hawkins  &  Powers 
Aviation  (and  operated  under  contract  to  the  US  Forest  Service  (USFS))  crashed  while 
performing  a  fire-fighter  mission  (i.e.,  a  fire  retardant  drop  over  a  mountain  drainage  valley)  near 
Walker  CA,  destroying  the  aircraft  and  killing  all  three  crew  members.  A  video  of  the  accident 
showed  both  wings  separating  the  aircraft  as  it  pulled  out  of  its  fire  retardant  drop  [J3].  Analysis 
of  the  video  showed  that  the  right  wing  separated  first.  A  brief  history  of  the  accident  aircraft 
which  was  converted  from  USAF  military  service  to  fire  fighting  operations  is  summarized  in 
Table  Jl. 


Table  Jl.  Accident  Aircraft  C-130A  History 


Owner/Operator 

Tail  No. 

Dates  of 
Owner¬ 
ship 

Flight 

Hours 

History 

Mission/Role 

USAF 

USAF  SN  56- 
0538 

1957-1978 

0- 

19,546.8 

Military  Transport 
Service 

USAF 

USAF  SN  56- 
0538 

1978-1988 

19,546.8 

Desert  Storage 

USFS/Helet  Valley 
Flying  Service 
(Contractor) 

Registration 

No.  N134FF 

1988 

19,546.8 

Acquire/Contract  for 
Installation  of 
Retardation  Tanks 

Hawkins  &  Powers 
Aviation 

(Contractor  )/USFS 

Registration 

No.  N130NP 

1988-2002 

19,546.8  - 
21,863 

Purchase  and  Operate  as 

Fire  Fighting  Air  Tanker 
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The  NTSB  found  that  the  probable  cause  of  the  accident  was  due  to  an  inflight  failure  of  the  right 
wing  due  to  fatigue  cracking  in  the  center  wing  lower  skin  and  underlying  structural  members 
[J4].  The  wing  detached  at  the  center  wing  box  beam  to  fuselage  attachment  location  [J.2.c]. 

The  NTSB  also  found  that  a  factor  contributing  to  the  accident  was  inadequate  maintenance 
procedures  to  detect  fatigue  cracking  [J4]. 

At  the  time  of  the  accident,  the  crack  in  the  right  wing  was  approximately  12-inch  long  (A 
picture  of  this  fatal  crack  can  be  found  in  J5).  This  crack  developed  from  two  cracks  that 
originated  in  fastener  holes  in  the  lower  wing  skin  under  a  forward  external  doubler  at  Center 
Wing  Station  (CWS)  56R  at  the  stringers  16  and  17  location.  The  cracked  fastener  holes  join  the 
external  doubler  and  the  internal  stringers  to  the  lower  skin  panel.  The  fastener-hole  cracks  grew 
as  undetected  cracks,  coalesced  and  then  further  grew  to  the  critical  length.  The  fatal  crack  was 
found  to  have  propagated  past  the  area  where  they  would  have  been  covered  by  the  doubler  and 
into  the  stringers  beneath  the  doubler  and  across  the  lap  joint  between  the  middle  skin  panel  and 
the  forward  skin  panel  [J6] . 

The  firefighting  C-130A  aircraft  received  restricted  category  special  airworthiness  certificates 
from  the  FAA  with  associated  operating  limitations.  Table  J2  summarizes  the  purpose  of  each 
restricted  category  certificate  received  and  the  associated  operating  limitations.  What  is  obvious 
from  the  table  is  that  the  firefighting  aircraft  would  be  operated  in  accordance  with  (IAW)  the 
USAF’s  operating,  service  and  maintenance  technical  orders  (T.O.s).  What  is  not  obvious  from 
the  table  is  that  the  firefighting  community  did  not  track  the  rate  at  which  damage  was  rapidly 
accumulating  as  a  result  of  the  more  severe  firefighting  operating.  Thus,  Hawkins  and  Powers 
Aviation  (H&P),  the  maintainer,  did  not  adjust  inspection  periods  to  account  for  this  effect. 

The  firefighting  industry  commissioned  a  firefighting  tanker  airplane  flight  envelope 
performance  study  during  the  period  between  1983  and  1989.  The  purpose  of  this  flight  load 
survey  was  to  establish  the  loads  experienced  fire  service  aircraft.  Airspeed  and  g-load 
exceedances  were  recorded.  The  envelope  performance  study  revealed  that  the  exceedances  on 
the  instrumented  airplanes  were  outside  the  operating  envelope  specified  by  the  Type  Certificate 
or  Supplemental  Type  Certificate.  Note  that  the  C-130A  aircraft  were  not  used  as  part  of  this 
envelope  performance  study. 

It  did  not  appear  that  the  firefighting  industry  envelope  performance  study  was  accompanied 
with  any  subsequent  fatigue  evaluations  of  the  effect  of  the  fire  service  mission  on  the  fatigue 
cracking  behavior  of  these  fire  service  aircraft.  In  their  narrative,  the  NTSB  summarized  the 
results  of  fatigue  life  evaluations  that  determined  the  impact  of  fire  fighting  operations  on  three 
other  aircraft.  In  one  case,  the  fatigue  evaluation  implied  that  there  was  no  life  effect;  however, 
in  the  other  two  fatigue  evaluations,  substantial  negative  impacts  to  the  life  of  aircraft  structure 
were  noted  [J6].  Subsequent  to  the  accident,  Lockheed  estimated  that  the  fire  service  mission 
was  more  severe  than  normal  military  operations  for  the  C-130A  aircraft,  i.e.,  requiring 
inspections  to  be  accomplished  12  times  more  frequently  than  for  typical  military  transport 
service  [J6]. 
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Table  J2.  Airworthiness  Certificate  Category  and  Operating  Limitations 


H&P 

Application 

Date/FAA 

Certification 

Date 

FAA  Office 

Restricted  Category 
Airworthiness  Certificate 

Accompanying  Operating 
Limitations 

10  Dec  1988/ 

15  Dec  1988 

Phoenix 
Manufactur¬ 
ing  Inspection 
Satellite 

Office 

(MISO) 

Special  Airworthiness 
certificate  issued  IAW  14.CFR 
21.185(b);  the  application 
indicated  that  the  aircraft 
which  conformed  to  the  type 
design  14  CFR  21.33  &  Type 
Certificate  (TC)  A15NM, 
rev.2 

Aircraft  must  be  operated 

IAW  USAF  Technical  Order 
(T.O.)  1C-130A-1  (airplane 
flight  manual)  and  serviced 
and  maintained  in 
compliance  with  USAF  T.O. 

1C-130A-2-1  through  1C- 
130A-2-13 

28  Dec  1988/ 

8  Aug  1989 

Helena  Flight 
Standards 
District  Office 
(FSDO) 

Reissued  for  the  purpose  of 
Carriage  of  Cargo 

Same  operating,  service  and 
maintenance  requirements 

1  June  1998 

Casper  Flight 
Standards 

Field  Office 
(FSFO) 

Rescinded  and  issued  new 
certificate  for  the  following 
special  purpose  operations: 
agriculture  missions,  forest 
and  wildlife  conservation, 
aerial  surveys,  and  any  other 
type  of  operation  approved  by 
the  FAA 

New  Special  Operating 
Limitation  sheet  which 
required  compliance  with 
the  same  operational  service 
and  maintenance  required  by 
USAF  T.O.s  as  previously 
required,  but  added  a 
requirement  that  the 
company  use  a  self- 
developed  maintenance 
document  entitled  “H&P-C- 
130A  Inspection  Guide” 

In  its  support  to  the  NTSB,  Lockheed  also  estimated  that  for  the  fatal  crack  size,  “the  center  wing 
failed  at  a  load  that  was  approximately  30  percent  of  the  design  ultimate  strength  of  the  center 
wing  and  that  the  presence  of  fatigue  cracks  in  multiple  locations  and  in  multiple  structural 
elements  reduced  the  residual  strength  to  approximately  50  percent  of  the  design  limit  load  and 
compromised  the  fail  safety  capability  of  the  structure.”  The  NTSB  also  summarized  for  the 
Lockheed  report  that,  “Failure  was  likely  caused  by  a  symmetric  maneuver  load  exceeding  2.0g 
during  the  final  drop  of  the  fire  retardant.”  The  vertical  load  factor  associated  with  the  final  drop 
was  estimated  by  the  NTSB  to  be  ~  2.4g  [J6] .  Lockheed’s  analysis  certainly  makes  the  case  that 
the  onset  of  multiple  element  damage,  a  form  of  widespread  fatigue  damage,  had  already 
occurred. 
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While  the  fire  service  C-130A  aircraft  were  being  inspected  in  accordance  with  the  USAF  T.O. 
1C-130A-36  inspection  manual,  there  were  no  specific  inspection  requirements  for  cracks  in  the 
fastener  holes  under  the  external  doublers  located  at  CWS  56R  or  56L.  The  C-130A  was 
designed  with  two  external  doublers  on  each  side  of  the  wing;  these  doublers  were  located 
inboard  and  outboard  of  CWS  61.  The  C-130A  aircraft  was  the  only  C-130  mission  design 
series  (MDS)  aircraft  with  this  doubler  configuration.  The  later  C-130  MDS  aircraft  had  a  single 
doubler  located  at  CWS  61.  The  1C-130A-36  (inspection  manual)  had  crack  inspection 
instructions  for  the  area  of  the  inboard  doublers  at  CSW  56,  but  no  unique  inspection 
requirement  for  the  cracks  in  the  fastener  holes  beneath  these  doublers.  The  H&P-C-130A 
Inspection  Guide,  also  called  the  Inspection  Planning  Guide,  (IPG- 182)  followed  these  same 
inspection  instructions. 

The  NTSB  [J6]  also  summarized  Lockheed’s  1970’s  service  life  analysis  tests  on  major  C-130 
components  (including  the  center  wing).  Results  of  the  evaluation  for  military  mission  profiles 
and  environmental  data  at  the  time  indicate  that  the  service  life  endurance  point  was  19,384 
flight  hours.  The  service  life  endurance  point  is  defined  as  the  life  where  50%  of  the  center 
wings  would  be  expected  to  have  major  repair  or  replacement  due  to  fatigue  cracks. 

Comparing  the  number  of  aircraft  flight  hours  on  the  failed  C-130A  firefighting  aircraft,  and  that 
of  the  center  wing  service  life  endurance  point,  21,863  and  19,384  hours,  respectively,  it  is 
apparent  in  hindsight  that  the  maintenance/inspection  program  should  have  been  revised  for 
more  thorough  detailed  inspections  at  a  number  of  C-130A  potential  cracking  locations  to 
maintain  airworthiness. 

Two  Aviation  Week  and  Space  Technology  articles  followed  the  impact  of  the  C-130A  accident 
and  a  similar  PB4Y  aircraft  accident  that  resulted  from  a  fatigue-related  wing  failure  on  the 
firefighting  capability  of  the  US  Forest  Service  [J7,  J8] . 
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APPENDIX  K 

HISTORICAL  SUMMARY  OF  U.S.  TESTING  APPROACHES  FOR 
DEMONSTRATING  AIRFRAME  FAIL-SAFETY 

by 

Charles  F.  Tiffany  and  Thomas  Swift 

In  the  1950s  Boeing  conducted  about  30  guillotine  tests  on  pressurized  sections  of  the  707 
fuselage  (called  Quonset  huts),  where  blades  were  dropped  through  various  structural 
configurations  until  crack  arrest  designs  were  achieved.  Figure  K1  is  a  photo  of  an  early  707 
Quonset  hut  showing  several  arrested  blade  penetrations  [Kl]. 


Figure  Kl:  Boeing  707  Quonset  Hut  Test 


Several  of  the  707  guillotine  tests  demonstrated  arrested  longitudinal  crack  lengths  greater 
than  2  frame  bays  in  length.  The  maximum-recorded  length  was  43.6  inches.  The  fail-safety 
of  the  707  fuselage  was  subsequently  demonstrated  by  an  Aer  Lingus  incident  in  1970  when 
a  fuselage  frame  failed  and  a  40  inch  skin  crack  was  arrested.  See  Appendix  A.  10  for  a 
discussion  of  the  Aer  Lingus  incident  in  the  Compendium  of  Accidents/Incident  Data. 

Fuselage  fail-safe  tests  were  continued  with  the  development  of  the  737,  but  with  a  double 
bladed  guillotine  so  as  to  sever  the  central  frame  as  well  as  the  skin.  The  test  fixture  is  shown 
in  Figure  K2;  the  double  bladed  penetration  is  shown  in  Figure  K3;  and,  the  final  two  bay 
arrested  crack  with  broken  frame  is  shown  in  Figure  K4. 
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Figure  K2:  Boeing  737  Quonset  Hut  Test  Setup 


Figure  K3:  Boeing  737  Blade  Penetration 


K2 


Figure  K4:  Arrested  Two-Bay  Crack  with  Fractured  Frame  in  Boeing  737  Fuselage 


The  final  crack  length  in  this  test  was  40  inches  when  the  crack  turned  and  the  skin  flapped  open. 
The  applied  pressure  was  about  16%  above  the  normal  operating  pressure.  This  result  was 
repeated  several  times  at  pressures  up  to  22%  above  the  operating  pressure. 

Many  additional  large  damage  fail-safe  tests  have  been  performed  on  the  747,  757,  767  and  777 
aircraft  and  are  scheduled  for  the  composite  787  design. 

Like  Boeing,  Douglas  Aircraft  was  developing  their  first  high  altitude  jet  transport  (i.e.,  the  DC- 
8)  at  the  time  of  the  Comet  accidents.  Also,  like  Boeing  they  embarked  on  development  testing 
to  ensure  that  their  new  airplane  had  crack  arrest  fail-safe  capability.  This  development  testing 
involved  many  fatigue  test  specimens,  more  than  30  large  curved  panel  tests  pressurized  fatigue 
tests  and,  finally,  wedge  penetration  tests  on  a  full-scale  pressurized  fuselage,  which  also  had 
inertial  loads  applied.  A  nitrogen  pressure  gun  with  a  15  inch  wide  blade  was  used  to  penetrate 
the  fuselage  shell  and  various  stiffening  elements.  Penetrations  were  made  at  six  different 
locations  on  the  fuselage  as  shown  in  Figure  K5  [K2] . 
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Figure  K5:  DC-8  Wedge  Penetration  Tests 


In  Test  number  5  the  15-inch  blade  penetrated  the  skin,  the  circumferential  frame,  the 
longitudinal  stringer  and  the  two  bay  crack  flapped  open  and  the  fuselage  safely  depressurized. 
This  is  illustrated  in  the  sketch  in  Figure  K6  and  shown  in  the  photograph  in  Figure  K7. 


Figure  K6:  Details  of  DC-8  Arrested  Fuselage  Crack 
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Figure  K7:  View  Inside  the  DC-8  Fuselage 


During  the  development  of  the  DC- 10  during  the  mid  to  late  1960’s  Douglas  had  another 
extensive  analysis  and  test  effort  to  ensure  the  large  damage  fail-safe  capability  of  the 
pressurized  fuselage.  The  entire  fuselage  was  analyzed,  tested  and  certified  to  be  able  to  sustain  a 
two-bay  longitudinal  skin  crack  with  both  the  central  frame  and  tear  strap  broken.  Also,  it  was 
analyzed,  tested  and  certified  to  be  able  to  sustain  a  two-bay  circumferential  crack  with  a  broken 
central  stiffener.  Numerous  developmental  tests  were  performed  to  select  materials,  to  correlate 
with  analyses,  to  assess  crack  stoppers,  and  to  finalize  detail  designs.  These  tests  included  small 
specimens,  stiffened  panels  and  pressurized,  externally  loaded  small  cylinders  and  large  curved 
panels.  Finally,  large  curved  panels  were  subjected  to  cyclic  internal  pressure,  external  loads, 
large  damage  and  static  over  pressure  to  demonstrate  the  fail-safe  capability  of  the  structure.  A 
sketch  of  the  two  most  important  residual  strength  tests  is  shown  in  Figure  K8  and  a  photograph 
of  the  curved  panel  vacuum  fatigue  test  machine  is  shown  in  Figure  K9. 
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Test  Goal:  T\m>  Bay  Skin 
Crack v\ith  Broken  Central 
Crack  Stopper  and  Frame 


Axial  Loading 


Hoop  Loading- 


Longitudianal  Splice 


.  .  Pressure 
Panel  1 

■  Skin  0.063  inch  Thick 
2024- T  3 

■  Axial  Stiffener 
Rolled  Hat  7075-T6 
Area  0.21 4  Sq  In. 

■  Crack  Stoppers 
3.25x0.016 
Titanium  8-1-1 

®  Frames 
7075-T6 
0.063  In  Tk 


Circumferential 
Sp'ice  ^ 


Panel  2 

■  Skin  0.071  Inch  Thick 
2024- T  3 

■Axial  Stiffeners 
Extrusion  7075-T6 
Area  0.312  Sq  In 

■  Crack  Stoppers 
2.8x0.025 
Titanium  8-1-1 

■  Frames 
7075-T6 
0.071  InTk 


Figure  K8:  DC-10  Fuselage  Curved  Panel  Tests 


Figure  K9:  DC-10  Curved  Panel  Fatigue  Test  Machine 
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Currently  fail-safe  design  damage  sizes  are  specified  in  US  manufacturer’s  internal  structural 
design  criteria.  Some  typical  design  sizes  are: 

•  A  completely  severed  frame,  tear  strap  and  the  two  adjacent  skin  bays  for  the  fuselage. 

•  A  completely  severed  stringer  and  adjacent  skin  bays  for  the  fuselage,  wing  or  empennage 
skin  and  stringers. 

•  A  completely  severed  stringer  and  at  least  one  adjacent  skin  bay  for  the  wing  and 
empennage  splicing  stringers. 

•  A  completely  severed  frame,  tear  strap  and  adjacent  bays  of  the  fuselage  longitudinal  lap 
splices. 

A  number  of  papers  on  predicting  the  residual  strength  and  crack  arrest  in  pressurized  fuselage 
structure  have  been  published.  Some  examples  of  residual  strength  curves  for  various  airplane 
fuselages  are  included  in  Appendix  1  of  TOGAA’s  Final  Report  [Kl] 
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